PT-2022-16146

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.6.1 Description The issue arises when Traefik, an HTTP reverse proxy and load balancer, skips the router transport layer security TLS configuration when the host header is a fully qualified domain name FQDN. This ca...

CVE-2022-22813

A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier tunneling communication network, they could potentially observe and manipulate traffic associated with product configuration...

Schneider Electric Easergy P40 信任管理问题漏洞

The Schneider Electric Easergy P40 is a series of protective relays for Mv, Hv, and Ehv protection from Schneider Electric, France. The Schneider Electric Easergy P40 suffers from a trust management issue vulnerability that stems from the fact that if an attacker could exploit the vulnerability t...

Linux jss 安全漏洞

ruby-jss is a Ruby framework for interacting with the JAMF Software Server JSS REST API. A security vulnerability exists in Linux jss that stems from a memory leak in a software TLS connection leading to an object serialization issue...

Reolink RLC-410W 信任管理问题漏洞

Reolink Rlc-410W is a Wifi security camera from Reolink China.A security vulnerability exists in the TLS hard-coded key of Reolink RLC-410W v3.0.0.13620121102, which can be exploited by attackers to obtain sensitive information...

The vulnerability in the implementation of the Transport Layer Security (TLS) protocol of the libcurl library allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Transport Layer Security TLS protocol implementation in the libcurl library is related to errors in security settings when the CURLOPTSSLCIPHERLIST configuration option is used. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain...

The vulnerability of the software for interacting with servers via CURL allows for bypassing authentication procedures, enabling attackers to compromise data integrity.

The vulnerability of the software for interacting with servers via CURL is related to incorrect processing of TLS 1.3 session mandates. Exploiting this vulnerability allows a remote attacker to compromise data integrity...

CVE-2022-23408

wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections without AEAD using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c...

DEBIAN-CVE-2022-23408

wolfSSL 5.x before 5.1.1 uses non-random IV values in certain situations. This affects connections without AEAD using AES-CBC or DES3 with TLS 1.1 or 1.2 or DTLS 1.1 or 1.2. This occurs because of misplaced memory initialization in BuildMessage in internal.c...

wolfSSL 安全特征问题漏洞

Wolfssl CyaSSL is a small, portable embedded SSL programming library for use by embedded system developers from Wolfssl USA. wolfSSL has a security vulnerability that stems from the use of non-random IV values for x prior to 5.1.1 under certain circumstances. This affects AES-CBC or DES3...

The vulnerability of the client’s TLS 1.3 security library at the transport layer, GnuTLS, is related to writing beyond the buffer boundaries, allowing an attacker to cause a service failure.

The vulnerability of the TLS 1.3 client-side security library GnuTLS relates to buffer overflow attacks. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

Mirantis Container Runtime 安全漏洞

Mirantis Container Runtime is an advanced runtime from Mirantis, Inc. It is used to efficiently run Swarm and Kubernetes containers on any substrate. A security vulnerability exists in Mirantis Container Runtime 20.10.8, which stems from a memory leak during the TLS handshake, which could be abus...

DELL Wyse Management Suite Encryption Issue Vulnerability

DELL Wyse Management Suite is Dell's hybrid cloud security management solution for Wyse thin client devices, designed to simplify IT management processes and enhance device security. DELL Wyse Management Suite has an encryption issue vulnerability that stems from the program's support for the...

CVE-2021-36337

Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle attacks thereby compromising Confidentiality and Integrity of data...

Dell Wyse Management Suite 加密问题漏洞

DELL Wyse Management Suite is Dell's hybrid cloud security management solution for Wyse thin client devices, designed to simplify IT management processes and enhance device security. DELL Wyse Management Suite has an encryption issue vulnerability that stems from the program's support for the...

NSS (Network Security Services) versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS S/MIME PKCS \#7 or PKCS \#12 are likely to be impacted. Applications using NSS for certificate validation or other TLS X.509 OCSP or CRL functionality may be impacted depending on how they configure NSS. *Note: This vulnerability does NOT impact Mozilla Firefox.* However email clients and PDF viewers that use NSS for signature verification such as Thunderbird LibreOffice Evolution and Evince are believed to be impacted. This vulnerability affects NSS < 3.73 and NSS < 3.68.1.

...

CVE-2021-42027

A vulnerability has been identified in SINUMERIK Edge All versions V3.2. The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and...

Siemens SINUMERIK 信任管理问题漏洞

Siemens SINUMERIK Edge is a combination of hardware and software that provides a machine-oriented system platform for applications that facilitate digital production support and optimization.SINUMERIK Edge Certificate Improper Validation VulnerabilityAffected software does not properly validate...

The vulnerability of the mechanism for verifying the authenticity of TLS connections on Apache Traffic Server allows a perpetrator to carry out a type of “man-in-the-middle” attack.

The vulnerability of the TLS authentication verification mechanism of the Apache Traffic Server web server is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...

AZL-7024 CVE-2021-43527 affecting package nss for versions less than 3.75-1

NSS Network Security Services versions prior to 3.73 or 3.68.1 ESR are vulnerable to a heap overflow when handling DER-encoded DSA or RSA-PSS signatures. Applications using NSS for handling signatures encoded within CMS, S/MIME, PKCS \7, or PKCS \12 are likely to be impacted. Applications using N...