CVE-2020-36168: Undefined Security Weakness

An issue was discovered in Veritas Resiliency Platform 3.4 and 3.5. It leverages OpenSSL on Windows systems when using the Managed Host addon. On start-up, it loads the OpenSSL library. This library may attempt to load the openssl.cnf configuration file, which does not exist. By default, on Windo...

CVE-2020-36161: Undefined Security Weakness

An issue was discovered in Veritas APTARE 10.4 before 10.4P9 and 10.5 before 10.5P3. By default, on Windows systems, users can create directories under C:. A low privileged user can create a directory at the configuration file locations. When the Windows system restarts, a malicious OpenSSL engin...

PT-2021-11947

Name of the Vulnerable Software and Affected Versions: Veritas Backup Exec versions prior to 16.2 Veritas Backup Exec version 20.6 before hotfix 298543 Veritas Backup Exec version 21.1 before hotfix 657517 Description: An issue in the server allows a low-privileged user to create a malicious...

PT-2021-11946

Name of the Vulnerable Software and Affected Versions: Veritas InfoScale versions 7.x through 7.4.2 Storage Foundation versions through 6.1 Storage Foundation HA versions through 6.1 InfoScale Operations Manager aka VIOM Windows Management Server versions 7.x through 7.4.2 Description: An issue...

PT-2021-11945

Name of the Vulnerable Software and Affected Versions: Veritas Desktop and Laptop Option DLO versions prior to 9.4 Description: An issue in Veritas Desktop and Laptop Option DLO allows a low-privileged user to create a malicious configuration file that can load a malicious OpenSSL engine, resulti...

Veritas Enterprise Vault Security Vulnerability

Veritas Enterprise Vault is an enterprise-grade file protection, archiving automation software from Veritas, USA. A security vulnerability exists in Veritas Enterprise Vault version 14.0 and earlier versions that allows a less-privileged user to create an openssl.cnff configuration file to load t...

Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution

Exploit Title: Aruba ClearPass Policy Manager 6.7.0 - Unauthenticated Remote Command Execution Date: 2020-07-06 Exploit Author: SpicyItalian Vendor Homepage: https://www.arubanetworks.com/products/security/network-access-control/ Version: ClearPass 6.7.x prior to 6.7.13-HF, ClearPass 6.8.x prior ...

CVE-2019-5443

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

Code injection

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

CVE-2019-5443

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

CVE-2019-5443: Improper Control of Generation of Code

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that will make curl = 7.65.1 automatically run the code as an openssl "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants...

Windows OpenSSL engine code injection

A non-privileged user or program can put code and a config file in a known non-privileged path under C:/usr/local/ that makes curl automatically run the code as an OpenSSL "engine" on invocation. If that curl is invoked by a privileged user it can do anything it wants. This flaw exists in the...

curl: Windows Privilege Escalation: Malicious OpenSSL Engine

Summary: The curl windows binaries are built with OpenSSL libraries and have an insecure path for the OPENSSLDIR build parameter. This path is set to c:\usr\local\ssl. When curl is executed it attempts to load openssl.cnf from this path. By default on windows, low privileged users have the...

PT-2019-3585

Name of the Vulnerable Software and Affected Versions curl versions 7.65.1 and earlier MySQL Server versions 5.7.27 and earlier, 8.0.17 and earlier Description The issue is related to incorrect code generation management in the libcurl library. It allows a non-privileged user or program to place...

UBUNTU-CVE-2016-4970

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service infinite loop...

OracleVM 3.2 : openssh (OVMSA-2016-0030)

The remote OracleVM system is missing necessary patches to address critical security updates : - change default value of MaxStartups - CVE-2010-5107 John Haxby - improve RNG seeding from /dev/random 681291,708056 - make ssh1's ConnectTimeout option apply to both the TCP connection and SSH banner...

[SECURITY] Fedora 20 Update: pkcs11-helper-1.11-3.fc20

pkcs11-helper is a library that simplifies the interaction with PKCS11 providers for end-user applications using a simple API and optional OpenSSL engine. The library allows using multiple PKCS11 providers at the same tim e, enumerating available token certificates, or selecting a certificate...

[SECURITY] Fedora 19 Update: pkcs11-helper-1.11-3.fc19

pkcs11-helper is a library that simplifies the interaction with PKCS11 providers for end-user applications using a simple API and optional OpenSSL engine. The library allows using multiple PKCS11 providers at the same tim e, enumerating available token certificates, or selecting a certificate...