MAL-2025-6232 Malicious code in plugin-basic-ssl (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60c91f97ac10fa598313b2e03c827655a79a9eb89adf780dbd0df721f49780a8 Any computer that has this package installed or running should be considered...

Malicious code in plugin-basic-ssl (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60c91f97ac10fa598313b2e03c827655a79a9eb89adf780dbd0df721f49780a8 Any computer that has this package installed or running should be considered...

The vulnerability of the mod_ssl function in the Apache HTTP Server allows attackers to compromise the integrity of the protected information.

The vulnerability of the modssl function in the Apache HTTP Server is related to the lack of measures to neutralize special control elements. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information from a remote location...

The vulnerability of the mod_ssl function in the Apache HTTP Server web server allows a hacker to gain unauthorized access to protected information.

The vulnerability of the modssl function in the Apache HTTP Server is related to access control errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

SonicWall SMA100 SSL-VPN Affected By Multiple Vulnerabilities

1 CVE-2025-40596 - Pre-Authentication Stack-Based Buffer Overflow VulnerabilityA Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service DoS or potentially results in code execution. CVSS Score: 7.3 CVSS Vecto...

SUSE-SU-2025:02475-1 Security update 4.3.16 for Multi-Linux Manager Server

This update fixes the following issues: cobbler: - Prevent crash during Cobbler startup on NFS environments bsc1240666 - Synchronize cobbler add and sync actions bsc1233371 - Exclude disabled profiles from buildiso gen bsc1230908 grafana-formula: - Version 4.3.0: Added SUSE Linux Enterprise Serve...

Exploit for Deserialization of Untrusted Data in Microsoft

Pre-Exploit Vulnerability Check for CVE-2025-53770 with Burp...

The vulnerability of the mod_ssl function in the Apache HTTP Server’s web server allows a hacker to cause a service failure.

The vulnerability of the modssl function in the Apache HTTP Server is related to deficiencies in the authentication process when processing the SSLEngine option. Exploiting this vulnerability allows a malicious actor to cause service failures using the TLS protocol...

curl: OpenSSL HTTP/3 bogus CURLINFO_TLS_SSL_PTR

Summary: curleasygetinfo CURLINFOTLSSSLPTR appears to return invalid SSL connection pointer for OpenSSL HTTP/3 connections. Using this SSL connection results in a crash, and potential other impacts. This issue does not happen with libcurl 8.14.1, suggesting that the bug is in libcurl itself or...

DEBIAN-CVE-2025-7394

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

HCL BigFix Server 10.0.x < 10.0.13 / 11.0.x < 11.0.4 Multiple Vulnerabilities (KB0120585)

The version of HCL BigFix Server installed on the remote host is 10.0.x prior to 10.0.13 or 11.x prior to 11.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the KB0120585 advisory. - HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in it...

Libssh: invalid return code for chacha20 poly1305 with openssl backend

...

USN-7639-1 apache2 vulnerabilities

It was discovered that the Apache HTTP Server incorrectly handled certain Content-Type response headers. A remote attacker could possibly use this issue to perform HTTP response splitting attacks. CVE-2024-42516 xiaojunjie discovered that the Apache HTTP Server modproxy module incorrectly handled...

UNC6148 Backdoors Fully-Patched SonicWall SMA 100 Series Devices with OVERSTEP Rootkit

A threat activity cluster has been observed targeting fully-patched end-of-life SonicWall Secure Mobile Access SMA 100 series appliances as part of a campaign designed to drop a backdoor called OVERSTEP. The malicious activity, dating back to at least October 2024, has been attributed by the Goog...

[SECURITY] Fedora 41 Update: gnutls-3.8.10-1.fc41

GnuTLS is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them. It provides a simple C language application programming interface API to access the secure communications protocols as well as APIs to parse and write X.509, PKCS 12, OpenPGP and...

Apache HTTP Server 2.4.35 < 2.4.64 Access Control Bypass Vulnerability - Windows

Apache HTTP Server is prone to an access control bypass vulnerability in modssl. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

SUSE CVE-2024-47252

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...

AZL-65112 CVE-2025-49812 affecting package httpd for versions less than 2.4.64-1

In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommend...

ALPINE-CVE-2025-49812

In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommend...

ALPINE-CVE-2024-47252

Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...