PT-2022-17427 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 5.2.0 Description: The issue concerns a TLS 1.3 server that cannot properly enforce mutual authentication. A client can omit the certificate verify message from the handshake and never present a certificate...

Important: Red Hat Security Advisory: cyrus-sasl security update

An update for cyrus-sasl is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

RLSA-2022:0658 Important: cyrus-sasl security update

The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer SASL. SASL is a method for adding authentication support to connection-based protocols. Security Fixes: cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL...

curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols

A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...

PT-2022-15009 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy affected versions not specified Description: The issue concerns Envoy, an open source edge and service proxy for cloud-native applications. It allows the re-use of TLS when certain certificate validation settings have changed from their...

Pexip Infinity 信任管理问题漏洞

Pexip Infinity Pexip Video Conferencing Cloud Collaboration Platform is a video conferencing cloud collaboration platform from the Norwegian company Pexip. The product provides high quality and secure cloud conferencing capabilities.A security vulnerability exists in versions of Pexip Infinity...

GHSA-P7W9-8MXW-P3G7 Improper Certificate Validation in Hutool

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

CVE-2022-22885

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

PT-2022-16146

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 2.6.1 Description The issue arises when Traefik, an HTTP reverse proxy and load balancer, skips the router transport layer security TLS configuration when the host header is a fully qualified domain name FQDN. This ca...

containerd v1.2.x can be coerced into leaking credentials during image pull

Impact If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer otherwise known as a “foreign layer”, the default containerd resolver will follow that URL to attempt to download it. In v1.2.x but not 1.3.0 o...

CVE-2022-23429

An improper boundary check in audio hal service prior to SMR Feb-2022 Release 1 allows attackers to read invalid memory and it leads to application crash...

Google Android 安全漏洞

Google Android is a Linux-based open-source operating system from Google, Inc. Google Android is vulnerable to arbitrary memory writes, which can be exploited by attackers to perform arbitrary memory writes and code execution due to incorrect boundary checking in the edenruntime hal service...

[SECURITY] Fedora 35 Update: php-laminas-form-2.17.1-1.fc35

The Laminas\Form is intended primarily as a bridge between your domain models and the View Layer. It composes a thin layer of objects representing form elements, an InputFilter, and a small number of methods for binding data to and from the form and attached objects. Documentation:...

Fedora: Security Advisory for php-laminas-form (FEDORA-2022-c138fbb8e0)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Optimism 安全漏洞

Optimism is a Layer 2 Optimistic Rollup network. It is designed to leverage the strong security guarantees of Ethernet while reducing its cost and latency. There is a security vulnerability in Optimism, no information about this vulnerability is available at this time, please stay tuned to CNNVD ...

CVE-2022-22813

A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier tunneling communication network, they could potentially observe and manipulate traffic associated with product configuration...

Secuwiz SecuwaySsl U 操作系统命令注入漏洞

Secuwiz SecuwaySsl U is a dedicated Ssl Vpn device from Secuwiz Korea. The Secuwiz SecuwaySsl U suffers from an operating system command injection vulnerability that can be exploited by an attacker to inject special characters when executing commands using the runCommand parameter...

Schneider Electric Easergy P40 信任管理问题漏洞

The Schneider Electric Easergy P40 is a series of protective relays for Mv, Hv, and Ehv protection from Schneider Electric, France. The Schneider Electric Easergy P40 suffers from a trust management issue vulnerability that stems from the fact that if an attacker could exploit the vulnerability t...

Stormshield Network Security 访问控制错误漏洞

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability in Stormshield 1.1.0 and 2.1.0 through 2.9.0 could allow an attacker to block client access to the VPN and gain access to sensitive information...

Linux jss 安全漏洞

ruby-jss is a Ruby framework for interacting with the JAMF Software Server JSS REST API. A security vulnerability exists in Linux jss that stems from a memory leak in a software TLS connection leading to an object serialization issue...