37 matches found
SUSE CVE-2026-50722
Libreswan, via the function RSAauthenticatehashsignaturepkcs115rsa, did not correctly verify the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload was encoded using RSASSA-PKCS1-v15 RFC 8017. A remote attacker can use a variation on the Bleichenbacher attack to forge the AUTH payload...
CVE-2026-12413
The CVE-2026-12413 issue affects Libreswan’s pluto daemon and is triggered by an invalidly formatted IKEv2 fragment. The root cause is an off-by-one error in the assertion within reassemble_v2_incoming_fragments(), which can cause the daemon to abort when handling certain outer payloads that are ...
CVE-2026-12413 IKEv2 Denial of Service via malformed fragmentation
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemblev2incomingfragments would ignore unknown outer payloads but still store these in a fixed size array msgdigest.digestPAYLIMIT...
CVE-2026-35424
Missing release of memory after effective lifetime in Windows Internet Key Exchange IKE Protocol allows an unauthorized attacker to deny service over a network...
PT-2026-40185
Missing release of memory after effective lifetime in Windows Internet Key Exchange IKE Protocol allows an unauthorized attacker to deny service over a network...
MiracleLinux 3 : ipsec-tools-0.6.5-13AXS3.1 (AXSA:2009-435:03)
The remote MiracleLinux 3 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2009-435:03 advisory. This is the IPsec-Tools package. You need this package in order to really use the IPsec functionality in the linux-2.5+ kernels. This package builds:...
EUVD-2022-37671
Malicious code in bioql PyPI...
EUVD-2023-31946
Malicious code in bioql PyPI...
Zyxel ATP Input Validation Error Vulnerability
Zyxel ATP is a firewall from China's Heqin Zyxel. The Zyxel ATP suffers from an input validation error vulnerability that stems from the presence of an integer overflow vulnerability, which could allow an unauthenticated attacker to cause a denial of service DoS on an affected device by sending a...
The vulnerability of the VPN package based on the IPSec protocol strongSwan is caused by a mistake in the charon-tkm process, allowing a hacker to execute arbitrary code.
The vulnerability of the VPN package based on the IPSec protocol and strongSwan is caused by a mistake in the charon-tkm process, where the Key Exchange Protocol IKE is implemented using the TKMv2 Trusted Key Manager. Exploiting this vulnerability allows an attacker operating remotely to execute...
CVE-2023-28238 Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
...
SUSE CVE-2002-1623
The design of the Internet Key Exchange IKE protocol, when using Aggressive Mode for shared secret authentication, does not encrypt initiator or responder identities during negotiation, which may allow remote attackers to determine valid usernames by 1 monitoring responses before the password is...
CVE-2023-21547
CVE-2023-21547 is a vulnerability in the Windows Internet Key Exchange (IKE) Extension causing a Denial-of-Service. Multiple connected sources identify it as a network-‑accessible issue in the IKE protocol that can be triggered remotely without user interaction, with the root cause described as a...
Denial of service
Internet Key Exchange IKE Protocol Denial of Service Vulnerability...
CVE-2022-38036 Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
...
KB5018418: Windows 11 Security Update (October 2022)
The remote Windows host is missing security update 5018418. It is, therefore, affected by multiple vulnerabilities - Internet Key Exchange IKE Protocol Denial of Service Vulnerability CVE-2022-38036 - Server Service Remote Protocol Elevation of Privilege Vulnerability CVE-2022-38045 - Microsoft...
CVE-2022-34721
Windows Internet Key Exchange IKE Protocol Extensions Remote Code Execution Vulnerability...
CVE-2022-34722
Windows Internet Key Exchange IKE Protocol Extensions Remote Code Execution Vulnerability...