JRuby-OpenSSL 安全漏洞

JRuby-OpenSSL is an add-on gem for JRuby from the JRuby team. A security vulnerability exists in JRuby-OpenSSL versions prior to 0.12.1 through 0.15.4, which stems from insufficient certificate hostname validation and could lead to a man-in-the-middle attack...

PT-2025-20241 · Jruby · Jruby +1

Name of the Vulnerable Software and Affected Versions: JRuby-OpenSSL versions 0.12.1 through 0.15.3 JRuby versions 9.3.4.0 through 9.4.12.0 JRuby version 10.0.0.0 Description: The issue concerns the verification of SSL certificates. When verifying these certificates, the hostname presented in the...

syslog-ng 安全漏洞

syslog-ng is an enhanced logging daemon from the syslog-ng team team. A wide range of input and output methods are supported: syslog, unstructured text, queues, SQL and NoSQL. A security vulnerability exists in syslog-ng versions prior to 4.8.2, which stems from the tlswildcardmatch function...

Tenable Identity Exposure < 3.77.11 Multiple Vulnerabilities (TNS-2025-07)

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.11. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2025-07, including the following: - Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may...

CVE-2025-37730

Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle MitM attack in “client” mode, as hostname verification in TCP output was not being performed when the sslverificationmode = full was set...

CVE-2025-37730 Logstash Improper Certificate Validation in TCP output

Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle MitM attack in “client” mode, as hostname verification in TCP output was not being performed when the sslverificationmode = full was set...

CVE-2025-37730 Logstash Improper Certificate Validation in TCP output

Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle MitM attack in “client” mode, as hostname verification in TCP output was not being performed when the sslverificationmode = full was set...

CVE-2025-37730 Logstash Improper Certificate Validation in TCP output

Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle MitM attack in “client” mode, as hostname verification in TCP output was not being performed when the sslverificationmode = full was set...

Logstash 8.17.6, 8.18.1, and 9.0.1 Security Update (ESA-2025-08)

Logstash Improper Certificate Validation in TCP output ESA-2025-08 Improper certificate validation in Logstash's TCP output could lead to a man-in-the-middle MitM attack in “client” mode, as hostname verification in TCP output was not being performed when the sslverificationmode = full was set...

K000151201: OpenSSL vulnerability CVE-2024-12797

Security Advisory Description Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to cryptography-43.0.1-cp37-abi3-manylinux_2_28_x86_64.whl CVE-2024-12797

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to cryptography-43.0.1-cp37-abi3-manylinux228x8664.whl CVE-2024-12797. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-12797 DESCRIPTION: Issue summary: Clients...

GO-2025-3648 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks in github.com/rancher/stev

Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle MitM attacks in github.com/rancher/stev. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

Improper Domain Validation

org.apache.httpcomponents.client5, httpclient5 is vulnerable to improper domain validation. The vulnerability is due to disabled domain checks where a bug in the PSL validation logic, affecting cookie management and host name verification, which allows an attacker to perform cookie injection or...

CVE-2025-24339

A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-the-Middle MitM, via a crafted HTTP request...

CVE-2025-24339

A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-the-Middle MitM, via a crafted HTTP request...

CVE-2025-24339

CVE-2025-24339 involves the web application of ctrlX OS. The vulnerability allows a remote, unauthenticated attacker to perform various attacks against users of the vulnerable system, including web cache poisoning and Man-in-the-Middle (MitM) via a crafted HTTP request. The CVSS 3.1 base metrics ...

CVE-2025-24339

A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-the-Middle MitM, via a crafted HTTP request...

CVE-2025-24339

A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-the-Middle MitM, via a crafted HTTP request...

Man-In-The-Middle (MITM)

github.com/rancher/flee is vulnerable to Man-in-the-Middle MitM attack. The vulnerability is due to improper certificate validation and Fleet automatically trusting remote server SSH certificates if not listed in the knownhosts file, allowing potential spoofing by an attacker...

Bosch Rexroth ctrlX OS 安全漏洞

Bosch Rexroth ctrlX OS is a Linux-based real-time operating system from Bosch Rexroth, an open control platform designed for industrial automation equipment. A security vulnerability exists in Bosch Rexroth ctrlX OS, which stems from mishandling of a web application and could lead to a...