920 matches found
The vulnerability of the mbedtls_ssl_read function in TLS and SSL implementations allows a attacker to compromise data integrity.
The vulnerability of the mbedtlssslread function in TLS and SSL protocols is related to the absence of buffer zeroing. Exploiting this vulnerability allows a remote attacker to compromise data integrity...
The vulnerability of TLS and SSL Mbed TLS implementations lies in the transmission of encrypted-protected information in an unencrypted form, allowing attackers to gain access to confidential data.
The vulnerability of TLS and SSL Mbed TLS implementations lies in the fact that the countermeasure “Lucky 13” does not correctly handle cases involving hardware acceleration. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...
The vulnerability of TLS and SSL Mbed TLS implementations lies in the exposure of information due to incompatibilities, allowing attackers to gain access to confidential data.
The vulnerability of TLS and SSL Mbed TLS implementations is related to the disclosure of information due to incompatibility. Exploiting this vulnerability allows an attacker to gain access to confidential data...
The vulnerability of the mbedtls_mpi_exp_mod function in implementations of TLS and SSL protocols allows a attacker to cause a service failure.
The vulnerability of the mbedtlsmpiexpmod function in TLS and SSL protocol implementations is related to the lack of data size limitations during calculations. Exploiting this vulnerability allows a remote attacker to cause service failures...
CVE-2022-0123
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services...
A man-in-the-middle attacker can inject false responses to the client's first few queries despite the use of SSL certificate verification and encryption.
...
AZL-8901 CVE-2021-23222 affecting package postgresql for versions less than 14.2-1
A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption...
curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols
A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...
Secuwiz SecuwaySsl U 操作系统命令注入漏洞
Secuwiz SecuwaySsl U is a dedicated Ssl Vpn device from Secuwiz Korea. The Secuwiz SecuwaySsl U suffers from an operating system command injection vulnerability that can be exploited by an attacker to inject special characters when executing commands using the runCommand parameter...
Cisco Small Business 缓冲区错误漏洞
Cisco Small Business is a switch from Cisco USA. A buffer error vulnerability exists in the Cisco Small Business RV Series routers, which results from improper validation of an SSL server certificate received when establishing a connection to a specific remote server. An attacker could exploit th...
CVE-2021-31562
The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly secured by SSL/TLS, and impersonate an...
postgresql: server processes unencrypted bytes from man-in-the-middle
It was found that a PostgreSQL server could accept plain text data during the establishment of an SSL connection. When a user is requesting a certificate based authentication, an active Person in the Middle could use this flaw in order to inject arbitrary SQL commands...
USN-5168-4 nss regression
USN-5168-3 fixed a vulnerability in NSS. Unfortunately that update introduced a regression that could break SSL connections. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Tavis Ormandy discovered that NSS incorrectly handled verifying DSA/RSA-PSS...
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...
nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
A remote code execution flaw was found in the way NSS verifies certificates. This flaw allows an attacker posing as an SSL/TLS server to trigger this issue in a client application compiled with NSS when it tries to initiate an SSL/TLS connection. Similarly, a server application compiled with NSS,...
foreman: possible man-in-the-middle in smart_proxy realm_freeipa
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if...
CVE-2021-42568
Sonatype Nexus Repository Manager 3.x through 3.35.0 allows attackers to access the SSL Certificates Loading function via a low-privileged account...
Northern.tech CFEngine 信任管理问题漏洞
Northern.tech CfEngine is an open source configuration management solution from Northern.tech, Inc. It is used to securely manage It infrastructure. A security vulnerability exists in Northern.tech CFEngine Enterprise versions 3.15.0 through 3.15.4 that stems from the program's lack of SSL...