Ericsson Erlang 授权问题漏洞

Ericsson Erlang is a general-purpose concurrency-oriented programming language from Ericsson, Sweden. A security vulnerability exists in Erlang versions prior to 23.3.4.15, 24.x up to 24.3.4.2, and 25.x up to 25.0.2, which stems from bypassing client authentication in certain client-side...

ForgeRock LDAP connector 安全漏洞

The ForgeRock LDAP connector is a connector from ForgeRock USA, Inc. It enables you to integrate synchronization services with LDAP v3 servers. A security vulnerability exists in ForgeRock LDAP connector versions prior to 1.5.20.9, which stems from a vulnerability that allows unauthenticated acce...

Freshworks FreshService 信任管理问题漏洞

Freshworks FreshService is a cloud-based IT help desk and service management solution from Freshworks, Inc. It enables organizations to streamline their IT operations. A security vulnerability exists in Freshworks FreshService macOS Agent versions prior to 4.4.0, FreshServce Linux Agent versions...

jetty: Resource exhaustion when receiving an invalid large TLS frame

When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing high CPU resources utilization. The highest threat from this vulnerability is to service availability...

PT-2022-12209 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions through 5.0.0 Description: The issue allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the...

CVE-2022-1632

An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of...

CVE-2022-38152

An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSLclear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct...

UBUNTU-CVE-2022-38152

An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSLclear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct...

golang: crypto/tls: session tickets lack random ticket_age_add

A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption...

Wolfssl 代码问题漏洞

Wolfssl CyaSSL is a small, portable embedded SSL programming library for embedded systems developers from Wolfssl, Inc. in the United States. A security vulnerability exists in Wolfssl versions prior to 5.5.0 that stems from the server crashing due to a segmentation error when a TLS 1.3 client...

CVE-2022-37177

HireVue Hiring Platform V1.0 suffers from Use of a Broken or Risky Cryptographic Algorithm. NOTE: this is disputed by the vendor for multiple reasons, e.g., it is inconsistent with CVE ID assignment rules for cloud services, and no product with version V1.0 exists. Furthermore, the rail-fence...

PT-2022-23857 · Hirevue · Hirevue Hiring Platform

Name of the Vulnerable Software and Affected Versions: HireVue Hiring Platform version V1.0 Description: The issue concerns the use of a broken or risky cryptographic algorithm. However, this is disputed by the vendor due to inconsistencies with CVE ID assignment rules for cloud services and the...

The vulnerability of the TLS protocol implementation in the Illumina Local Run Manager software allows a perpetrator to compromise the confidentiality of protected information, including login credentials.

The vulnerability of the TLS protocol implementation in the Illumina Local Run Manager lies in the transmission of data in an open manner. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality of protected information, including login credentials...

Session tickets lack random ticket_age_add in crypto/tls

...

CVE-2022-37437

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions...

OESA-2022-1833 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under so...

DEBIAN-CVE-2022-30629

Non-random values for ticketageadd in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption...

golang: crypto/tls: session tickets lack random ticket_age_add

A flaw was found in the crypto/tls golang package. When session tickets are generated by crypto/tls, it is missing the ticket expiration. This issue may allow an attacker to observe the TLS handshakes to correlate successive connections during session resumption...

OESA-2022-1815 openjdk-11 security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Java SE: 7u311, 8u301, 11.0.12, 17; Oracle GraalVM Enterprise Edition: 20.3.3 and 21.2.0. Difficult ...

Intel® AMT and Intel® Standard Manageability Advisory

Summary: Potential security vulnerabilities in the Intel® Active Management Technology AMT and Intel® Standard Manageability may allow escalation of privilege or information disclosure. Intel is releasing prescriptive guidance to mitigate these potential vulnerabilities. Vulnerability Details:...