11110 matches found
Westermo Lynx 206-F2G Code Injection Vulnerability
The Westermo Lynx 206-F2G is a Layer 3 industrial Ethernet switch from Westermo, Sweden, powered by the Westermo WeOS network operating system. A security vulnerability exists in the Westermo Lynx 206-F2G. An attacker can exploit this vulnerability to execute malicious code...
The vulnerability lies in the implementation of the TLS protocol in the cURL command-line utility. This allows a hacker to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the TLS protocol’s command-line utility cURL stems from an erroneous preservation of the session identifier due to lack of verification of certificate revocation. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions and gain unauthorized...
PT-2024-13090 · Unknown · Automotive Multimedia
Name of the Vulnerable Software and Affected Versions: Automotive Multimedia affected versions not specified Description: The issue is related to memory corruption in Automotive Multimedia due to improper access control in HAB. Recommendations: At the moment, there is no information about a newer...
Westermo Lynx 206-F2G Cross-Site Request Forgery Vulnerability
The Westermo Lynx 206-F2G is a Layer 3 industrial Ethernet switch from Westermo, Sweden, powered by the Westermo WeOS network operating system. A security vulnerability exists in the Westermo Lynx 206-F2G that stems from cross-site requests for forged tokens being predictable...
Westermo Lynx 206-F2G Security Vulnerability
The Westermo Lynx 206-F2G is a Layer 3 industrial Ethernet switch from Westermo, Sweden, powered by the Westermo WeOS network operating system. A security vulnerability exists in the Westermo Lynx 206-F2G. An attacker can exploit this vulnerability to execute malicious code...
CVE-2024-0202
A security vulnerability has been identified in the cryptlib cryptographic library when cryptlib is compiled with the support for RSA key exchange ciphersuites in TLS by setting the USERSASUITES define, it will be vulnerable to the timing variant of the Bleichenbacher attack. An attacker that is...
DEBIAN-CVE-2023-50782
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data...
PT-2024-15469 · B&R · B&R Automation Runtime
Name of the Vulnerable Software and Affected Versions: B&R Automation Runtime affected versions not specified Description: The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0, and TLSv1.1. A network-based attacker can exploit the flaws...
PT-2024-15383
Name of the Vulnerable Software and Affected Versions cryptlib affected versions not specified Description A security issue has been identified in the cryptlib cryptographic library when it is compiled with support for RSA key exchange ciphersuites in TLS. This makes it vulnerable to the timing...
Dell BSAFE Unmaintained Third Party Component Vulnerability
Dell BSAFE is a security software product from Dell, Inc. that supports cryptographic algorithms, certificate chain validation, and Transport Layer Security TLS encryption suites, among other things, to help users achieve a variety of security goals for their applications. An unmaintained...
Dell BSAFE Micro Edition Suite Information Disclosure Vulnerability
The Dell BSAFE Micro Edition Suite is a Dell development toolkit that provides encryption, certificate and transport layer security for c/c++ applications, devices and systems. An information disclosure vulnerability exists in Dell BSAFE Micro Edition Suite versions prior to 4.5.2, which can be...
Important: kernel
Issue Overview: A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol L2TP. A missing lock when clearing skuserdata can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. CVE-2022-4129 In...
AZL-34061 CVE-2024-0853 affecting package curl for versions less than 8.8.0-1
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status OCSP stapling test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check...
CLSA-2024-1706698462 java-1.8.0-openjdk: Fix of 6 CVEs
Upgrade to shenandoah-jdk8u402-b06. That fixes following CVEs: - CVE-2024-20918: Array out-of-bounds access due to missing range check in C1 compiler - CVE-2024-20919: JVM class file verifier flaw allows unverified bytecode execution - CVE-2024-20921: Range check loop optimization issue -...
OCSP verification bypass with TLS session reuse
curl inadvertently kept the SSL session ID for connections in its cache even when the verify status OCSP stapling test failed. A subsequent transfer to the same hostname could then succeed if the session ID cache was still fresh, which then skipped the verify status check...
curl 安全漏洞
Haxx curl is a set of file transfer tools that work at the command line using URL syntax. A security bypass vulnerability exists in Haxx curl due to a flaw that retains the connected SSL session ID in its cache even if the authentication state OCSP binding test fails. An attacker could use this...
Server-Side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF via the process of fetching payment or payment provider information. An attacker can gain control over the destination URL of the HttpClient used in the API classes, leading to requests to unexpected...
Cisco IOS XE Software Layer 2 Tunneling Protocol DoS (cisco-sa-ios-xe-l2tp-dos-eB5tuFmV)
According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the Layer 2 Tunneling Protocol L2TP feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device...
TrueLayer.NET Code Issue Vulnerability
TrueLayer.NET is a .Net client for TrueLayer by TrueLayer UK. A code issue vulnerability exists in TrueLayer.NET. An attacker could use this vulnerability to gain control of the target URL of the HttpClient used in the API class...
