PT-2026-4942

Name of the Vulnerable Software and Affected Versions OpenSSL versions 3.3 through 3.6 Description A flaw exists in OpenSSL where the SSL CIPHER find function, when used in a QUIC protocol client or server, can experience a NULL pointer dereference if it receives an unknown cipher suite from its...

Security Bulletin: IBM Db2 and IBM WebSphere Application Server traditional used by ISVG - Identity Manager have multiple vulnerabilities

Summary IBM Security Verify Governance - Identity Manager ships with IBM Db2 and IBM WebSphere Application Server traditional. Information about security vulnerabilities affecting these dependencies has been published in security bulletins. Vulnerability Details Refer to the security bulletins...

CVE-2023-4333

Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server...

Code injection

Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server...

CVE-2023-4333 Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server

Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server...

CVE-2023-4333: Inadequate Encryption Strength

Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server...

K16948: Apache Tomcat vulnerability CVE-2007-1858

Security Advisory Description The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other,...

Security Bulletin: Multiple vulnerabilities in IBM Rational Policy Tester (CVE-2013-0531, CVE-2013-0440, CVE-2013-4062, CVE-2013-4061, CVE-2013-2407)

Abstract Previous releases of IBM Rational Policy Tester are affected by multiple vulnerabilities reported in 3rd party components bundled with the product as well as in proprietary IBM code. These vulnerabilities include Java components, weak cipher suites, invalid certificate warnings and URL...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2021-2206)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2015:2088-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2015:2088-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IBM Websphere Application Server Network Deployment Untrusted Data Deserialization Remote Code Execution', 'Description' = % This module exploits...

Insecure Cipher Suites

excon uses insecure SSL cipher suites. The usage of insecure 3DES ciphers enables a remote attacker to carry out man-in-the-middle attacks...

Security Bulletin: Vulnerability in DHE key exchange algorithm affects IBM UrbanCode Deploy (CVE-2015-4000)

Summary SSL cipher suites using non-Elliptic Curve Diffie-Hellman key exchange algorithms with key sizes of less than 1024 are vulnerable to man in the middle attacks. Previous versions of the IBM UrbanCode Deploy server left these cipher suites enabled. Vulnerability Details CVE ID: CVE-2015-400...

LocalTapiola: OpenSSL Padding Oracle Attack (CVE-2016-2107) on viestinta.lahitapiola.fi

Hello Lahitapiola Security Team, I would like to make two reports: 1. Subdomain viestinta.lahitapiola.fi is vulnerable to CVE-2016-2107 . 2. All the Lahitapiola domains/subdomains in scope of bug bounty have weak cipher suites and are susceptible to various SSL related attacks. Subdomain...

CVE-2016-2462

OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data AAD array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173...

CVE-2016-2461

OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles resets of the Additional Authenticated Data AAD array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bugs 27324690 and 27696681...

SUSE-SU-2015:2088-1 Security update for LibVNCServer

The LibVNCServer package was updated to fix the following security issues: - bsc897031: fix several security issues: CVE-2014-6051: Integer overflow in MallocFrameBuffer on client side. CVE-2014-6052: Lack of malloc return value checking on client side. CVE-2014-6053: Server crash on a very large...

SUSE-SU-2015:2088-2 Security update for LibVNCServer

The LibVNCServer package was updated to fix the following security issues: - bsc897031: fix several security issues: CVE-2014-6051: Integer overflow in MallocFrameBuffer on client side. CVE-2014-6052: Lack of malloc return value checking on client side. CVE-2014-6053: Server crash on a very large...

openSUSE Security Update : LibVNCServer (openSUSE-2015-851)

The LibVNCServer package was updated to fix the following security issues : - bsc897031: fix several security issues : - CVE-2014-6051: Integer overflow in MallocFrameBuffer on client side. - CVE-2014-6052: Lack of malloc return value checking on client side. - CVE-2014-6053: Server crash on a ve...