91811 matches found
SonicWall Secure Mobile Access < 10.2.1.10-62sv (SNWLID-2023-0018)
The version of SonicWall Secure Mobile Access installed on the remote host is prior to 10.2.1.10-62sv. It is, therefore, affected by multiple vulnerabilities as referenced in the SNWLID-2023-0018 advisory: - Improper neutralization of special elements in the SMA100 SSL-VPN management interface...
SonicWall SMA100 Appliances OS Command Injection Vulnerability
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user...
Security Bulletin: IBM Predictive Maintenance and Quality (PMQ) UI: Missing Secure Attribute in Encrypted Session (SSL) Cookie (CVE-2020-4423)
Summary PMQ UI web application sends non-secure cookies over SSL. It may be possible to steal user and session information cookies that was sent during an encrypted session. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Version...
VulnCheck KEV: CVE-2023-44221
SonicWall SMA100 appliances contain an OS command injection vulnerability in the SSL-VPN management interface that allows a remote, authenticated attacker with administrative privilege to inject arbitrary commands as a 'nobody' user...
BIT-AIRFLOW-2024-25141
When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...
CVE-2024-42177
HCL MyXalytics is affected by SSL∕TLS Protocol affected with BREACH & LUCKY13 vulnerabilities. Attackers can exploit the weakness in the ciphers to intercept and decrypt encrypted data, steal sensitive information, or inject malicious code into the system...
CVE-2021-35246
The application fails to prevent users from connecting to it over unencrypted connections. An attacker able to modify a legitimate user's network traffic could bypass the application's use of SSL/TLS encryption and use the application as a platform for attacks against its users...
CVE-2025-43918
SSL.com before 2025-04-19, when domain validation method 3.2.2.4.14 is used, processes certificate requests such that a trusted TLS certificate may be issued for the domain name of a requester's email address, even when the requester does not otherwise establish administrative control of that...
Erlang/OTP (Erlang OTP) Improper Certificate Validation Vulnerability (Dec 2024)
Erlang/OTP Erlang OTP is prone to an improper certificate validation vulnerability in the ssl component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
Shrinking Lifespans, Growing Risk: The Final Certificate Countdown
Recent Developments Severely Shorten Certificate Lifespans. The SSL/TLS ecosystem is shifting rapidly and not in a way that favors already stretched teams. Historically, certificates could be valid for up to 10 years. Certificates now face drastically shorter lifespans. DigiCert and other major...
GHSA-4P4H-9GVQ-7XFG Duplicate Advisory: Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-93mv-x874-956g. This link is maintained to preserve external references. Original Description The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can...
PYSEC-2025-34
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...
CVE-2025-46417
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...
PYSEC-2025-34
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...
CVE-2025-46417
CVE-2025-46417 affects Picklescan up to version 0.0.25, where unsafe globals exclude ssl, allowing ssl.get_server_certificate to exfiltrate data via DNS after deserialization. Exploitation details are not provided in the connected documents. CVSS vectors indicate high impact under NVD (7.5) and m...
CVE-2025-46417
The unsafe globals in Picklescan before 0.0.25 do not include ssl. Consequently, ssl.getservercertificate can exfiltrate data via DNS after deserialization...
CVE-2025-2769
Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Bdrive NetDrive. An attacker must first obtain the ability to execute low-privileged code on the target system i...
Bdrive NetDrive 代码问题漏洞
Bdrive NetDrive is a network drive from Bdrive that connects to various cloud services or remote file storage. A code issue vulnerability exists in Bdrive NetDrive that stems from loading an OpenSSL configuration file from a non-secure location, which could result in local elevation of privilege...
SonicWALL SonicOS SSLVPN 代码问题漏洞
SonicWALL SonicOS SSLVPN is a virtual private network for secure remote access from SonicWALL USA. A code issue vulnerability exists in SonicWALL SonicOS SSLVPN that originates from a null pointer dereference in the SSLVPN virtual office interface, which could result in a denial of service...
