Fossil has an unspecified vulnerability

Fossil is a simple, highly reliable distributed software configuration management system. A security vulnerability exists in Fossil that stems from a hostname check that is commonly skipped during certificate validation. This issue affects: versions prior to 2.15, versions prior to 2.14. No detai...

Insecure Validation

Fossil has insecure validation. The vulnerability exists due to the system skipping the hostname check during TLS certificate validation...

CVE-2021-36377

Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...

DEBIAN-CVE-2021-36377

Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...

CVE-2021-36377

Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...

Input validation

Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...

CVE-2021-36377

Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...

CVE-2021-36377

Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...

UBUNTU-CVE-2021-36377

Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...

CVE-2021-36377

CVE-2021-36377 affects Fossil prior to 2.14.2 and 2.15.x before 2.15.2, where TLS hostname verification can be bypassed due to hostname checks being skipped during certificate validation. Impact: potential MITM spoofing of Fossil repositories and information disclosure. Remediation: upgrade Fossi...

CVE-2021-3547

OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration...

Fossil 信任管理问题漏洞

Fossil is a simple, highly reliable distributed software configuration management system. A security vulnerability exists in Fossil that stems from a hostname check that is commonly skipped during certificate validation. This issue affects: versions prior to 2.15, versions prior to 2.14. No detai...

PT-2021-20922 · Openvpn · Openvpn 3 Core Library

Name of the Vulnerable Software and Affected Versions: OpenVPN 3 Core Library versions 3.6 through 3.6.1 Description: The issue allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the...

OpenVPN 信任管理问题漏洞

OpenVPN is a software package for creating virtual private network VPN encrypted tunnels from US-based OpenVPN, which uses the OpenSSL library to encrypt data and control information and allows the created VPN to be authenticated using a public key, an electronic certificate, or a...

MGASA-2021-0339 Updated avahi packages fix a security vulnerability

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahishostnameresolverstart function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this...

USN-5008-1 avahi vulnerabilities

Thomas Kremer discovered that Avahi incorrectly handled termination signals on the Unix socket. A local attacker could possibly use this issue to cause Avahi to hang, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. CVE-2021-3468 It...

WordPress Any Hostname plugin <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by ABISHEIK M in WordPress Any Hostname plugin versions = 1.0.6. Solution Deactivate and delete. This plugin has been closed as of May 28, 2021 and is not available for download. Reason: Security Issue...

Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it PoC As admin, put the following payload in the "Allowed host" setting of the plugin /wp-admin/options-general.phpany-hostname...

Any Hostname <= 1.0.6 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it As admin, put the following payload in the "Allowed host" setting of the plugin /wp-admin/options-general.phpany-hostname:...

HoneyCreds - Network Credential Injection To Detect Responder And Other Network Poisoners

HoneyCreds network credential injection to detect responder and other network poisoners. Requirements Requires Python 3.6+ tested on Python 3.9 smbprotocol cffi splunk-sdk Installation git clone https://github.com/Ben0xA/HoneyCreds.git cd HoneyCreds pip3 install -r requirements.txt Running python...