apache-commons-text: variable interpolation RCE

A flaw was found in Apache Commons Text packages 1.5 through 1.9. The affected versions allow an attacker to benefit from a variable interpolation process contained in Apache Commons Text, which can cause properties to be dynamically defined. Server applications are vulnerable to remote code...

[SECURITY] Fedora 40 Update: proftpd-1.3.8c-3.fc40

ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based...

RFC7250 handshakes with unauthenticated servers don't abort as expected

...

CISA and Partners Release Advisory on Ghost (Cring) Ransomware

Today, CISA—in partnership with the Federal Bureau of Investigation FBI and Multi-State Information Sharing and Analysis Center MS-ISAC—released a joint Cybersecurity Advisory, StopRansomware: Ghost Cring Ransomware. This advisory provides network defenders with indicators of compromise IOCs,...

CVE-2025-24903

libsignal-service-rs is a Rust version of the libsignal-service-java library which implements the core functionality to communicate with Signal servers. Prior to commit 82d70f6720e762898f34ae76b0894b0297d9b2f8, any contact may forge a sync message, impersonating another device of the local user...

FreeBSD : OpenSSL -- Man-in-the-Middle vulnerability (a64761a1-e895-11ef-873e-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a64761a1-e895-11ef-873e-8447094a420f advisory. The OpenSSL project reports: RFC7250 handshakes with unauthenticated servers don't abort as expected...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2024-12797 RFC7250 handshakes with unauthenticated servers don't abort as expected

Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...

CVE-2024-12797

Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...

OpenSSL -- Man-in-the-Middle vulnerability

The OpenSSL project reports: RFC7250 handshakes with unauthenticated servers don't abort as expected High. Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEE...

ALSA-2025:1330 Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected CVE-2024-12797 For more...

Important: openssl security update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected CVE-2024-12797 For more...

HPESBHF04802 rev.1 - Certain HPE StoreEasy Servers Using Certain Intel Processor BIOS, INTEL-SA-01194, UPLR3 Intel Data Streaming Accelerator Advisory, Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1470 Performance - Prior to v2.4401-17-2025 HPE StoreEasy 1470 Storage - Prior to v2.4401-17-2025 HPE StoreEasy 1570 Performance - Prior to v2.4401-17-2025 HPE...

HPESBHF04799 rev.1 - Certain HPE ProLiant DL/ML, Alletra, Edgeline and Synergy Servers Using Certain Intel Processor BIOS, INTEL-SA-01194, UPLR3 Intel Data Streaming Accelerator Advisory, Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Alletra 4110 -Prior to v2.4401-17-2025 HPE Alletra 4120 -Prior to v2.4401-17-2025 HPE Alletra 4140 -Prior to v2.4401-17-2025 HPE ProLiant DL110 Gen11 -Prior to v2.4401-17-20...

HPESBHF04800 rev.1 - Certain HPE StoreEasy Servers Using Certain Intel Processor BIOS, INTEL-SA-01213, 2025.1 IPU - Intel SGX Advisory, Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE StoreEasy 1470 Performance - Prior to v2.4401-17-2025 U63 ROM Family HPE StoreEasy 1470 Storage - Prior to v2.4401-17-2025 U63 ROM Family HPE StoreEasy 1570 Performance -...

HPESBHF04794 rev.2 - Certain HPE ProLiant DL/ML, Alletra, Apollo, Edgeline, MicroServer and Synergy Servers Using Certain Intel Processor BIOS, INTEL-SA-01213, 2025.1 IPU - Intel SGX Advisory, Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Alletra 4110 - Prior to v2.4401-17-2025 HPE Alletra 4120 - Prior to v2.4401-17-2025 HPE Alletra 4140 - Prior to v2.4401-17-2025 HPE ProLiant DL110 Gen11 - Prior to...

HPESBHF04790 rev.2 - Certain HPE ProLiant DL/ML/XL, Alletra, Edgeline and Synergy Servers Using Certain Intel Processor BIOS, INTEL-SA-01139, 2025.1 IPU - UEFI Firmware Advisory, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Alletra 4110 - Prior to v2.4401-17-2025 HPE Alletra 4120 - Prior to v2.4401-17-2025 HPE Alletra 4140 - Prior to v2.4401-17-2025 HPE ProLiant DL110...

DragonRank Exploits IIS Servers with BadIIS Malware for SEO Fraud and Gambling Redirects

Threat actors have been observed targeting Internet Information Services IIS servers in Asia as part of a search engine optimization SEO manipulation campaign designed to install BadIIS malware. "It is likely that the campaign is financially motivated since redirecting users to illegal gambling...

Allowed HTTP Methods Enumeration

Enumerates which HTTP methods are allowed. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

CVE-2021-39162

Pomerium is an open source identity-aware access proxy. Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event. This can lead to a DoS in the presence of untrusted upstream servers. 0.15.1 contains an upgraded envoy binary...