108 matches found
CVE-2026-1778 TLS disabled by default in select aws/sagemaker-python-sdkย configurations
Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed...
Amazon SageMaker Python SDK ๅฎๅ จๆผๆด
Amazon SageMaker Python SDK is a development toolkit provided by Amazon, Inc., for building, training, and deploying machine learning models. Versions of the Amazon SageMaker Python SDK prior to v3.1.1 and v2.256.0 contained security vulnerabilities. These vulnerabilities stemmed from the disabli...
PT-2026-5709
Name of the Vulnerable Software and Affected Versions Amazon SageMaker Python SDK versions prior to 3.1.1 Amazon SageMaker Python SDK versions prior to 2.256.0 Description The SageMaker Python SDK has an issue where TLS certificate verification is disabled for HTTPS connections when importing a...
Envoy ๅฎๅ จๆผๆด
Envoy is an Enphase open source gateway program for connecting smart home devices. A security vulnerability exists in Envoy versions 1.33.12, 1.34.10, 1.35.6, 1.36.2, and prior versions, which stems from the mTLS certificate matcher incorrectly handling certificates embedded with null bytes, whic...
EUVD-2017-17262
Malware in sbrugna...
EUVD-2022-2775
Malicious code in bioql PyPI...
EUVD-2022-28071
Malicious code in bioql PyPI...
[SECURITY] [DLA 4303-1] nextcloud-desktop security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4303-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 18, 2025 https://wiki.debian.org/LTS -...
Mozilla Firefox ๅฎๅ จๆผๆด
Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability exists in Mozilla Firefox versions prior to 140, which stems from allowing WebAuthn challenges despite invalid TLS certificates, which could lead to security risks...
CVE-2025-48057
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Prior to versions 2.12.12, 2.13.12, and 2.14.6, the VerifyCertificate function can be tricked into incorrectly treating certificates as vali...
DEBIAN-CVE-2025-47279
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...
UBUNTU-CVE-2025-47279
Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...
Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs
Impact What kind of vulnerability is it? Who is impacted? Description: This vulnerability affects confidential client applications, including daemons, web apps, and web APIs. Under specific circumstances, sensitive information such as client secrets or certificate details may be exposed in the...
CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs
Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...
New Stealer Uses Invalid Cert To Compromise Systems
New Stealer Uses Invalid Cert To Compromise Systems By Mohinder Gill, Mallikarjun Wali and Sangram Mohapatro ยท November 07, 2024 A new Stealer has been making the rounds. Its name: Fickle. Fickle Stealer is a new Rust-based information stealer that spreads through various attack vectors, includin...
The vulnerability of the TPM2_GENERATED_VALUE() function in the TCG TPM2 TPM2 Software Stack, related to incorrect input validation, allows attackers to generate arbitrary price data that cannot be detected by Fapi_VerifyQuote.
The vulnerability of the TPM2GENERATEDVALUE function in the TCG TPM2 TPM2 Software Stack lies in the lack of checks to ensure that the magical number in the TPM2GENERATEDVALUE certificate is valid. Exploiting this vulnerability allows an attacker to generate arbitrary quote data that cannot be...
Rocky Linux 9 : compat-openssl11 (RLSA-2022:4899)
The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:4899 advisory. - The BNmodsqrt function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function i...
SUSE CVE-2023-5422
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresult function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary securit...
UBUNTU-CVE-2023-5422
The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresult function is not used the certificated is trusted always and it can not be ensured that the certificate satisfies all necessary securit...
Mozilla: Click-jacking certificate exceptions through rendering lag
The Mozilla Foundation Security Advisory describes this flaw as: The error page for sites with invalid TLS certificates was missing the activation-delay Firefox uses to protect prompts and permission dialogs from attacks that exploit human response time delays. If a malicious page elicited user...