4230 matches found
UBUNTU-CVE-2021-29495
Nim is a statically typed compiled systems programming language. In Nim standard library before 1.4.2, httpClient SSL/TLS certificate verification was disabled by default. Users can upgrade to version 1.4.2 to receive a patch or, as a workaround, set "verifyMode = CVerifyPeer" as documented...
jetty: Resource exhaustion when receiving an invalid large TLS frame
When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large greater than 17408 TLS frame that is incorrectly handled, causing high CPU resources utilization. The highest threat from this vulnerability is to service availability...
OESA-2021-1170 curl security update
cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: curl 7.63.0 to and including 7.75.0 includes vulnerability that allows a malicious HTTPS proxy to MITM a connection due to bad handling of TLS...
The vulnerability of the implementation of TLS and SSL protocols in Cisco Firepower Threat Defense’s microprogrammable network interfaces allows attackers to trigger a device reboot or cause a service failure.
The vulnerability of the TLS and SSL protocols implemented by Cisco Firepower Threat Defense’s microprogramming-based network interface controllers is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to...
May 4, 2021, update for Outlook 2016 (KB5001921)
None None...
Exim 资源管理错误漏洞
Exim was developed at Cambridge University as a Message Transfer Agent MTA for Unix systems connected to the Internet. A post-release reuse vulnerability in smtpreset in Exim when providing TLS encryption over OpenSSL can be exploited by an attacker to achieve remote code execution...
CVE-2021-1402
A vulnerability in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service DoS condition. The vulnerability is due to insufficient validati...
Cisco Firepower Threat Defense 输入验证错误漏洞
Cisco Firepower Threat Defense FTD is unified software that provides next-generation firewall services. A denial-of-service vulnerability exists in the software-based SSL/TLS message handler of Cisco Firepower Threat Defense, which can be exploited by an attacker to cause a process crash by sendi...
nss: TLS 1.3 CCS flood remote DoS Attack
A flaw was found in the way NSS handled CCS ChangeCipherSpec messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability...
Datagram Transport Layer Security (DTLS) Protocol Detection
Detection of services supporting the Datagram Transport Layer Security DTLS protocol. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2021-27400
HashiCorp Vault and Vault Enterprise Cassandra integrations storage backend and database secrets engine plugin did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1...
envoyproxy/envoy: NULL pointer dereference in TLS alert code handling
A NULL pointer dereference vulnerability was found envoyproxy/envoy. This flaw allows an attacker to establish a TLS session that sends an invalid TLS alert code, causing a NULL pointer exception to occur that crashes the application, resulting in a denial of service. The highest threat from this...
envoyproxy/envoy: NULL pointer dereference in TLS alert code handling
A NULL pointer dereference vulnerability was found envoyproxy/envoy. This flaw allows an attacker to establish a TLS session that sends an invalid TLS alert code, causing a NULL pointer exception to occur that crashes the application, resulting in a denial of service. The highest threat from this...
HashiCorp Vault 信任管理问题漏洞
Hashicorp HashiCorp Vault is a private key access management tool from HashiCorp Hashicorp USA. A security vulnerability exists in HashiCorp Vault versions 1.5.1 and later that stems from an inability to validate TLS certificates...
OESA-2021-1147 openssl security update
OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation...
PT-2021-11225 · Dell · Dell Powerscale Onefs
Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.1.0 through 9.1.0 Description: The issue is related to the LDAP Provider's inability to connect over TLSv1.2, which may make it easier for a malicious actor to eavesdrop and decrypt traffic. This issue does no...
Denial of service vulnerability in bundled Jetty
Jenkins bundles Winstone-Jetty, a wrapper around Jetty, to act as HTTP and servlet server when started using java -jar jenkins.war. This is how Jenkins is run when using any of the installers or packages, but not when run using servlet containers such as Tomcat. Jenkins 2.285 and earlier, LTS...
openssl: NULL pointer dereference in signature_algorithms processing
A flaw was found in openssl. A server crash and denial of service attack could occur if a client sends a TLSv1.2 renegotiation ClientHello and omits the signaturealgorithms extension but includes a signaturealgorithmscert extension. The highest threat from this vulnerability is to system...
Improper Certificate Validation
Overview Affected versions of this package are vulnerable to Improper Certificate Validation. TLS hostname is not validated sufficiently. Remediation There is no fixed version for tweetstream...