chromium-browser: IP address spoofing to servers

Inappropriate implementation in TLS in Google Chrome prior to 77.0.3865.75 allowed a remote attacker to spoof client IP address to websites via crafted TLS connections...

The vulnerability of the TLS (Transport Layer Security) protocol implementation in Windows operating systems allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the TLS Transport Layer Security protocol implementation in Windows operating systems is related to deficiencies in session fixation. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information by connecting...

Security Bulletin: TLS padding vulnerability affects IBM Netezza Performance Portal (CVE-2014-8730)

Summary Transport Layer Security TLS padding vulnerability via a POODLE Padding Oracle On Downgraded Legacy Encryption like attack affects IBM Netezza Performance Portal. Vulnerability Details CVE-ID: CVE-2014-8730 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information...

PT-2019-11840 · Jenkins · Jenkins Cadence Vmanager Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Cadence vManager Plugin versions prior to 2.7.1 Description: The issue concerns the disabling of SSL/TLS and hostname verification globally for the Jenkins master JVM. This affects the security of the Jenkins master JVM, potentially...

The vulnerability of the Java Secure Socket Extension (JSSE) component of the OpenJDK project, a programming language for Java, allows attackers to gain access to confidential data.

The vulnerability of the Java Secure Socket Extension JSSE component of the OpenJDK project, a programming language, is related to errors in processing the attached OCSP response during TLS handshake. Exploiting this vulnerability can allow an attacker operating remotely to gain access to...

October 15, 2019—KB4520012 (Preview of Monthly Rollup)

None None...

October 15, 2019—KB4520015 (Preview of Monthly Rollup)

None None...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

CVE-2019-1318

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'...

Microsoft Windows Transport Layer Security Spoofing Vulnerability

A spoofing vulnerability exists when Transport Layer Security TLS accesses non- Extended Master Secret EMS sessions. An attacker who successfully exploited this vulnerability may gain access to unauthorized information. To exploit the vulnerability, an attacker would have to conduct a...

KB4520004: Windows 10 Version 1709 October 2019 Security Update

The remote Windows host is missing security update 4520004. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. CVE-2019-1340 - A spoofing vulnerability exists...

KB4519998: Windows 10 Version 1607 and Windows Server 2016 October 2019 Security Update

The remote Windows host is missing security update 4519998. It is, therefore, affected by multiple vulnerabilities : - A spoofing vulnerability exists when Microsoft Browsers does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could impersonate a user...

KB4520011: Windows 10 October 2019 Security Update

The remote Windows host is missing security update 4520011. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge HTML-based. The vulnerability could corrupt...

KB4517389: Windows 10 Version 1903 October 2019 Security Update

The remote Windows host is missing security update 4517389. It is, therefore, affected by multiple vulnerabilities : - An elevation of privilege vulnerability exists in Windows AppX Deployment Server that allows file creation in arbitrary locations. CVE-2019-1340 - A spoofing vulnerability exists...

The vulnerability of the TLS protocol implementation in the software platform of IOx network devices from Cisco Systems Inc. allows a attacker to cause a service failure.

The vulnerability of the TLS protocol implementation in the IOx software platform of Cisco Systems Inc. exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending specially crafted TLS packets to the IOx web...

CVE-2019-6652

In BIG-IQ 6.0.0-6.1.0, services for stats do not require authentication nor do they implement any form of Transport Layer Security TLS...

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

PT-2019-18234 · F5 · F5 Big-Iq

Name of the Vulnerable Software and Affected Versions: F5 BIG-IQ versions 6.0.0 through 6.1.0 Description: The issue concerns a lack of authentication and Transport Layer Security TLS in services for statistics. This means that these services can be accessed without proper verification and...