SUSE SLED15: postgresql10 / postgresql10-contrib / postgresql10-devel / etc (SUSE-SU-2021:4058-1)

The remote SUSE Linux SLED15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4058-1 advisory. - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake bsc1192516. -...

Fortinet FortiProxy SSL VPN Cross-Site Request Forgery Vulnerability

Fortinet FortiProxy SSL VPN is an application from Fortinet, Inc. provides an intrusion detection feature.Fortinet FortiProxy SSL VPN suffers from a cross-site request forgery vulnerability that can be exploited by unauthenticated attackers to conduct cross-site request forgery CSRF attacks...

OPENSUSE-SU-2021:1584-1 Security update for postgresql10

This update for postgresql10 fixes the following issues: - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake bsc1192516. - CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake bsc1192516. This update was imported...

UBUNTU-CVE-2021-4044

Internally libssl in OpenSSL calls X509verifycert on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error for example out of memory. Such a negative return value is mishandled by OpenSSL and will cause an IO...

CVE-2021-44549 SMTPS server hostname not checked when making TLS connection to SMTPS server

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

SUSE-SU-2021:4058-1 Security update for postgresql10

This update for postgresql10 fixes the following issues: - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake bsc1192516. - CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake bsc1192516...

OPENSUSE-SU-2021:4058-1 Security update for postgresql10

This update for postgresql10 fixes the following issues: - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake bsc1192516. - CVE-2021-23222: Make libpq reject extraneous data after an SSL or GSS encryption handshake bsc1192516...

Apache Sling Commons Messaging Mail 信任管理问题漏洞

Apache Sling Commons Messaging Mail is an open source messaging mail service from the Apache Foundation in the U.S. A trust management issue vulnerability exists in Apache Sling Commons Messaging Mail 1.0.0, which stems from the Apache Sling Commons Messaging Mail provides a simple layer on top o...

Pluck Access Control Error Vulnerability

Pluck is a content management system CMS developed using the PHP language. an access control error vulnerability exists in Pluck-CMS Pluck, which stems from a missing SSL certificate validation issue in updateapplet.php, which could lead to a man-in-the-middle attack. No details of the...

CVE-2021-31747

Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in updateapplet.php, which could lead to man-in-the-middle attacks...

CVE-2021-31747

Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in updateapplet.php, which could lead to man-in-the-middle attacks...

Input validation

Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in updateapplet.php, which could lead to man-in-the-middle attacks...

CVE-2021-31747

CVE-2021-31747 : In Pluck 4.7.15, the code path update_applet.php omits SSL certificate validation, enabling potential man-in-the-middle attacks. Affected component is the update mechanism in Pluck-CMS; impact is limited to MITM risk described in multiple sources (e.g., NVD/Red Hat/CNVD entries)....

CVE-2021-31747

Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in updateapplet.php, which could lead to man-in-the-middle attacks...

Windows Interactive Powershell Session, Reverse TCP SSL

Listen for a connection and spawn an interactive powershell session over SSL Module Options msf use payload/windows/x64/powershellreversetcpssl msf payloadpowershellreversetcpssl show actions ...actions... msf payloadpowershellreversetcpssl set ACTION msf payloadpowershellreversetcpssl show optio...

Windows Interactive Powershell Session, Reverse TCP SSL

Listen for a connection and spawn an interactive powershell session over SSL Module Options msf use payload/windows/powershellreversetcpssl msf payloadpowershellreversetcpssl show actions ...actions... msf payloadpowershellreversetcpssl set ACTION msf payloadpowershellreversetcpssl show options...

Windows Interactive Powershell Session, Reverse TCP SSL

Interacts with a powershell session on an established SSL socket connection Module Options msf use payload/cmd/windows/powershellreversetcpssl msf payloadpowershellreversetcpssl show actions ...actions... msf payloadpowershellreversetcpssl set ACTION msf payloadpowershellreversetcpssl show option...

CVE-2021-26108

A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering...

CVE-2021-26109

An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution...

CVE-2021-26109

An integer overflow or wraparound vulnerability in the memory allocator of SSLVPN in FortiOS before 7.0.1 may allow an unauthenticated attacker to corrupt control data on the heap via specifically crafted requests to SSLVPN, resulting in potentially arbitrary code execution...