56940 matches found
PT-2026-104052
Name of the Vulnerable Software and Affected Versions EasyIO NEO versions prior to 3.3b25 Description Cleartext transmission of sensitive information allows for Man In the Middle attacks, where an attacker intercepts data between two parties. In this case, attackers can intercept credentials via...
Rocky Linux 8 [CIQ] Security Update: openssh / openssh-askpass / openssh-askpass-debuginfo / etc (crlsa-2025_16823)
The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202516823 advisory. openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled CVE-2025-26465 Tenable has extracted the preceding description block directly from the CIQ...
Rocky Linux 9.6 [TuxCare] Security Update: ruby / ruby-default-gems / ruby-devel / ruby-doc / ruby-libs / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784073521)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784073521 advisory. - Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.1...
AlmaLinux 9.6 [TuxCare] Security Update: openssl / openssl-devel / openssl-libs / openssl-perl (ALMALINUX9.6:CLSA-2025:1751550314)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1751550314 advisory. - Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated...
AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785499004)
The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785499004 advisory. - A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection...
AlmaLinux 9.2 [TuxCare] Security Update: openssh / openssh-askpass / openssh-clients / openssh-keycat / etc (ALMALINUX9.2:CLSA-2025:1741290429)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1741290429 advisory. - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a...
AlmaLinux 9.2 [TuxCare] Security Update: mutt (ALMALINUX9.2:CLSA-2026:1783434809)
The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1783434809 advisory. - In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an...
CentOS Linux 8 [TuxCare] Security Update: bpftool / kernel / kernel-core / kernel-cross-headers / etc (CENTOS-STREAM8:CLSA-2026:1778260978)
The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1778260978 advisory. - In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSGSPLICEPAGE...
CVE-2026-67105: Cleartext Transmission of Sensitive Information
HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...
TamarinAgent
UI de Revisión de IR de Protocolo Guiada por Confianza Este repositorio contiene una UI local con intervención humana para el modelado de protocolos de seguridad asistido por LLM. Admite el flujo de trabajo descrito en nuestro trabajo: IR de Protocolo Guiada por Confianza para el Modelado de...
CVE-2026-43503
CVE-2026-43503 DirtyClone - 概念验证 - SecurewithUmer DirtyClone 的概念验证 — 一种 Linux 内核本地权限提升漏洞。 此仓库包含一个有效的概念验证 ，该验证允许非特权本地用户通过利用通过克隆套接字缓冲区导致的页缓存损坏来获取 root 权限。 关于 DirtyClone DirtyClone CVE-2026-43503 是 Dirty 家族的第四个成员（DirtyPipe → DirtyFrag → DirtyClone）。 它滥用了在使用带有 ESP-in-UDP 的 TEE netfilter 目标时...
Ssh Mitm
SSH-MITM SSH-MITM es un proxy SSH de tipo man-in-the-middle para auditorías de seguridad y pruebas de penetración. Soporta la intercepción de sesiones SSH, SCP y SFTP, reenvío de agente, reenvío de puertos y más. Este repositorio era un espejo y ya no se actualiza. Los repositorios oficiales son:...
CVE-2026-19553
A flaw was found in Python. When establishing secure connections using the SSLContext.wrapbio function with hostname checking enabled, the module fails to validate that a target server hostname is supplied. Because of this missing check, certificate hostname verification is silently skipped rathe...
Improper Certificate Validation
Snowflake drivers are vulnerable to Improper Certificate Validation. The vulnerability is due to improper validation of OCSP responses and treating definitive verification failures as transient, which allows a man-in-the-middle attacker with a revoked certificate and its private key to establish ...
gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...
XCP_ng_CVE-2026-43284_tester
XCP-ng Dirty Frag 诊断工具 — CVE-2026-43284 一个社区诊断工具，用于判断 XCP-ng dom0 主机是否暴露于 CVE-2026-43284 （“Dirty Frag”），这是 Linux 内核 xfrm-ESP 子系统中的一个本地权限提升漏洞。 TL;DR — 所有当前 XCP-ng 版本（8.1、8.2、8.3）运行标准 4.19 dom0 内核的都在受影响代码范围内。截至 2026 年 5 月，官方尚未发布 XCP-ng 补丁。本工具能明确告知您的主机是否暴露，并提供安全的临时缓解措施。 背景 “Dirty Frag”...
CVE-2023-28252
CVE-2023-28252 El resumen de lo aprendido sobre la vulnerabilidad de Windows CVE-2023-28252 Así que este fin de semana estuve practicando la máquina Aero en Hack The Box. Es muy divertido jugarla cuando puedes simular un ataque del mundo real a una máquina con Windows 11. Después de completarla,...
OESA-2026-4137 jss security update
Java Security Services JSS is a java native interface which provides a bridge for java-based applications to use native Network Security Services NSS. This only works with gcj. Other JREs require that JCE providers be signed. Security Fixes: A flaw was found in JSS Java Security Services. The...
