CVE-2021-36756

CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation...

CVE-2021-36756

CVE-2021-36756 affects CFEngine Enterprise 3.15.0–3.15.4 with Missing SSL Certificate Validation, exposed over network (per CVSS) and impacting confidentiality/integrity. Connected advisories confirm a fix is available; update cfengine packages via vendor advisories (e.g., ROSA/Red Hat) to remedi...

CVE-2021-35236

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted...

Design/Logic Flaw

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted...

CVE-2021-35236

Kiwi Syslog Server 9.7.2 and earlier is affected by CVE-2021-35236 due to the SSL cookie lacking the Secure attribute, allowing the cookie to be sent over unencrypted HTTP where the application is reachable via HTTP+HTTPS. The root cause is an unsecured Secure flag on the cookie, which can lead t...

CVE-2021-35236 Missing Secure Flag From SSL Cookie

The Secure flag is not set in the SSL Cookie of Kiwi Syslog Server 9.7.2 and previous versions. The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted...

Cisco Firepower Threat Defense（FTD）和Cisco Adaptive Security Appliances Software（ASA Software）安全漏洞

Cisco Firepower Threat Defense FTD is a suite of unified software from Cisco that provides next-generation firewall services. A security vulnerability exists in Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliances Software ASA Software SSL/TLS Denial, which arises from an...

PT-2021-20858 · Unknown · Kiwi Syslog Server

Name of the Vulnerable Software and Affected Versions: Kiwi Syslog Server versions 9.7.2 and earlier Description: The Secure flag is not set in the SSL Cookie, which means the cookie can be sent over unencrypted requests if the application is accessible over both HTTP and HTTPS. This poses a risk...

Cisco Firepower Threat Defense和Cisco Adaptive Security Appliances Software 输入验证错误漏洞

Cisco Firepower Threat Defense FTD is a suite of unified software from Cisco that provides next-generation firewall services. An input validation error vulnerability exists in Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliances Software ASA Software, which is caused by...

Security update for busybox (important)

openSUSE Security Update: Security update for busybox Announcement ID: openSUSE-SU-2021:3531-1 Rating: important References: 1099260 1099263 1121426 1184522 951562 Cross-References: CVE-2011-5325 CVE-2018-1000500 CVE-2018-1000517 CVE-2018-20679 CVE-2021-28831 CVSS scores: CVE-2011-5325 NVD : 7.5...

SSL/TLS: Safe/Secure Renegotiation Support Status

Checks and reports if a remote SSL/TLS service supports safe/secure renegotiation. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021

Summary Vulnerabilities detected in Node.js versions before v14.16.2 affects IBM Rational® Application Developer for WebSphere® Software. Vulnerability Details CVEID: CVE-2021-3711 DESCRIPTION: OpenSSL is vulnerable to a buffer overflow, caused by improper bounds checking by the EVPPKEYdecrypt...

Security Bulletin: Vulnerability in SSLv3 affects IBM Packaging Utility (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in IBM Packaging Utility Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follo...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect the IBM Installation Manager and IBM Packaging Utility (CVE-2014-6593 and CVE-2015-0138)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 6 and 7 that are used by IBM Installation Manager and IBM Packaging Utility. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the...

Security Bulletin: Vulnerability in RC4 stream cipher affects the IBM Installation Manager and IBM Packaging Utility (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects the IBM Installation Manager and IBM Packaging Utility Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. A...

CLSA-2021-1634925634 Fixed 9 CVEs in squid34

CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack - CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service - CVE-2020-25097: fix improper input validation allowing HTTP smuggling from trusted client -...

CLSA-2021-1634925600 Fixed CVEs in squid: CVE-2020-15049, CVE-2020-14058

CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service - CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack...

Oracle HTTP Server (Oct 2021 CPU)

The 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0 versions of HTTP Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2021 CPU advisory. - Vulnerability in the Oracle WebLogic Server Proxy Plug-In product of Oracle Fusion Middleware component: SSL...

CVE-2021-35666

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: OSSL Module. The supported version that is affected is 11.1.1.9.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle HTTP Server. Successful...

Design/Logic Flaw

The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security HSTS. HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade...