SUSE CVE-2022-37026

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS...

PT-2023-18850 · Connectwise · Connectwise Automate

Name of the Vulnerable Software and Affected Versions: Connectwise Automate version 2022.11 Description: The issue concerns cleartext authentication, where authentication is performed via HTTP with SSL disabled. This is reportedly controlled by a configuration option, allowing customers to choose...

OpenJDK: handshake DoS attack against DTLS connections (JSSE, 8287411)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 11.0.17, 17.0.5, 19.0.1; Oracle GraalVM Enterprise Edition: 20.3.8, 21.3.4 and 22.3.0. Easily exploitable vulnerability allows...

PT-2023-1503 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM versions 7.4 through 7.5 Description: The issue is related to the disclosure of information in the IBM QRadar SIEM system. It allows an attacker to expose protected information. The problem arises from the copying of certifica...

K20105555: F5 SSL Orchestrator may fail to stop an attacker from exfiltrating data on a compromised client system (SNIcat)

Security Advisory Description An attacker may be able to exfiltrate data from a target system sitting behind F5 SSL Orchestrator by inserting data into the TLS SNI field. This approach assumes that the attacker has already compromised, and is in full control of, the target system to be able to...

PT-2022-27427 · Slixmpp +1 · Slixmpp +1

Name of the Vulnerable Software and Affected Versions: Slixmpp versions prior to 1.8.3 Description: The issue lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp. Recommendations: For versions prior to 1.8.3, update to version...

The vulnerability of SSL VPN configuration loading mechanisms of Sophos firewalls allows attackers to execute arbitrary code.

The vulnerability of SSL VPN configuration loading on Sophos firewalls lies in the possibility of code injection. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

erlang/otp: Client Authentication Bypass

A Client Authentication Bypass was found in Erlang/OTP. This issue occurs in certain client-certification situations for SSL, TLS, and DTLS...

Sophos Firewall 操作系统命令注入漏洞

Sophos Firewall is a firewall from Sophos UK. Sophos Firewall version 19.5GA suffers from an operating system command injection vulnerability that stems from the fact that an attacker can achieve command injection leading to code execution by an administrator via its SSL VPN configuration file...

PT-2022-5774 · Sophos · Sophos Firewall

Name of the Vulnerable Software and Affected Versions: Sophos Firewall versions prior to 19.5 GA Description: The issue allows for OS command injection, enabling the execution of code via SSL VPN configuration uploads. This can be exploited by a remote attacker to execute arbitrary code...

Vulnerability fixed in Erlang OTP

Erlang developers have fixed a vulnerability in Erlang OTP. A malicious party could exploit the vulnerability to gain access to sensitive data, when using Erlang SSL in combination with client authentication. Erlang has released updates to fix the vulnerability in OTP 25.1; for more information,...

October 18, 2022—KB5020440 (OS Build 10240.19509) Out-of-band

None None...

October 17, 2022—KB5020436 (OS Build 20348.1131) Out-of-band

None None...

KB5020449: Out-of-band update for Windows Server 2012: October 17, 2022

KB5020449: Out-of-band update for Windows Server 2012: October 17, 2022 Summary This update includes improvements for the following: It addresses an issue that might affect some types of Secure Sockets Layer SSL and Transport Layer Security TLS connections. These connections might have handshake...

KB5020447: Out-of-band update for Windows 8.1 and Server 2012 R2: October 17, 2022

KB5020447: Out-of-band update for Windows 8.1 and Server 2012 R2: October 17, 2022 Summary This update includes improvements for the following: It addresses an issue that might affect some types of Secure Sockets Layer SSL and Transport Layer Security TLS connections. These connections might have...

October 17, 2022 Non-security update (KB5020446) Out-of-band

None None...

October 17, 2022—KB5020435 (OS Builds 19042.2132, 19043.2132, and 19044.2132) Out-of-band

None None...

October 17, 2022—KB5020387 (OS Build 22000.1100) Out-of-band

None None...

DEBIAN-CVE-2022-37026

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS...

Ericsson Erlang 授权问题漏洞

Ericsson Erlang is a general-purpose concurrency-oriented programming language from Ericsson, Sweden. A security vulnerability exists in Erlang versions prior to 23.3.4.15, 24.x up to 24.3.4.2, and 25.x up to 25.0.2, which stems from bypassing client authentication in certain client-side...