OESA-2023-1941 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, a...

OESA-2023-1912 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, a...

What is SSL VPN?

Deciphering SSL VPN: An In-depth Perspective Pivoting our lens towards data in this digital era, akin to the transition observed during the oil boom, we've realized that the fodder for importance today is safeguarding data while it voyages through global networks. SSL VPN Secure Sockets Layer...

PT-2023-30682

Name of the Vulnerable Software and Affected Versions HTTPie version 3.2.2 Description The issue allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack due to missing SSL certificate validation. Recommendations For HTTPie version 3.2.2, consider...

Important: squid

Issue Overview: Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a...

python: TLS handshake bypass

Python ssl.SSLSocket is vulnerable to a bypass of the TLS handshake in certain instances for HTTPS servers and other server-side protocols that use TLS client authentication such as mTLS. This issue may result in a breach of integrity as its possible to modify or delete resources that are...

The vulnerability of the SSL VPN Tunnel component of the SonicOS operating system, which allows a intruder to increase their privileges

The vulnerability of the SSL VPN Tunnel component of the SonicOS operating system is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

CVE-2023-41712

SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash...

SonicWALL SonicOS Security Vulnerabilities

SonicWALL SonicOS is a suite of operating systems from SonicWALL, Inc. designed for use with SonicWall firewall appliances. A security vulnerability exists in SonicWALL SonicOS that stems from improper management of SonicOS authentication privileges in SSL VPN tunnels, which allows a user to...

CVE-2023-41675

A use after free vulnerability CWE-416 in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2.0 through 7.2.2 and version 7.0.0 through 7.0.8 may allow an unauthenticated remote attacker to crash the WAD process via multiple crafted packets reaching pro...

The vulnerability of the Web Server Authentication Required VPN-portal Clientless Secure Sockets Layer (SSL) micro-programming system of Cisco Adaptive Security Appliance (ASA) allows a attacker to carry out XSS attacks.

The vulnerability of the Web Server Authentication Required VPN-portal Clientless Secure Sockets Layer SSL micro-programming system of Cisco Adaptive Security Appliance ASA exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicio...

keylime: registrar is subject to a DoS against SSL connections

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections...

The vulnerability of the e-Tugra certificate verification package for SSL certificates allows a perpetrator to execute a “man-in-the-middle” attack.

The vulnerability of the e-Tugra SSL Certificate verification package’s root certificates is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor to execute a “man-in-the-middle” attack...

MindsDB Security Vulnerabilities

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in MindsDB versions prior to 23.7.4.0, which stems from a security issue in dremiohandler.py, where invoking a request with verify=False disables SSL certificate checking...

CVE-2023-38200

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections...

SUSE CVE-2023-38200

A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections...

Moderate: openssl security and bug fix update

OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength general-purpose cryptography library. Security Fixes: openssl: Possible DoS translating ASN.1 object identifiers CVE-2023-2650 openssl: Denial of service by...

OpenBSD 资源管理错误漏洞

OpenBSD is a cross-platform, BSD-based, UNIX-like operating system from the Canadian OpenBSD project team. A security vulnerability exists in OpenBSD versions prior to 7.2 errata 026, and prior to 7.3 errata 004, which stems from a double-release or post-release reuse issue with SSLclear...

CVE-2023-34363

An issue was discovered in Progress DataDirect Connect for ODBC before 08.02.2770 for Oracle. When using Oracle Advanced Security OAS encryption, if an error is encountered initializing the encryption object used to encrypt data, the code falls back to a different encryption mechanism that uses a...

The vulnerability of the implementations of TLS and SSL protocols in microprogrammable network interface devices from Cisco Adaptive Security Appliance (ASA) and Cisco Firepower Threat Defense (FTD) series 2100 allows attackers to induce service interruptions.

The vulnerability of the implementations of TLS and SSL protocols in microprogrammable network interface devices from Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD series 2100 is related to insufficient validation of input data. Exploiting this vulnerability can all...