CVE-2021-32686

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback a...

CVE-2021-32686

CVE-2021-32686 affects the PJSIP pjproject library prior to 2.11.1. The issue is a race condition in the SSL socket: (1) the accepted socket lacks a group lock, causing a race between callback and destroy, and (2) the SSL socket parent/listener may be destroyed during TLS handshake. These intermi...

Insecure SSL Configuration

curl uses insecure SSL configurations. The curlsslconfigmatches attempts to compare whether two SSL connections have identical SSL security options and could potentially reuse a connection that is less secure or uses different security options such as capath, cainfo or certificate/issuer pinning...

Insecure TLS Configuration

maven uses insecure TLS configurations. Non-SSL repository references are allowed by default and would potentially allow for man-in-the-middle attacks...

CVE-2021-25699

The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attacker to elevate to the privileges of the running process via placing a specially crafted dll in a build configuration directory...

Dell OpenManage Enterprise Hardcoded Credentails / Privilege Escalation / Deserialization

Dell OpenManage Enterprise versions up to 3.6.1 suffer from multiple hard-coded credential issues, multiple privilege escalation, weak permissions, authentication bypass, and other vulnerabilities. Please find a text-only version below sent to security mailing lists. The complete version on...

Hashicorp Consul Missing SSL Certificate Validation

HashiCorp Consul before 1.10.1 and Consul Enterprise has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated...

GHSA-25GF-8QRR-G78R Hashicorp Consul Missing SSL Certificate Validation

HashiCorp Consul before 1.10.1 and Consul Enterprise has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated...

Insecure SSL Certificate Validation

github.com/hashicorp/consul has a missing SSL certificate validation. The vulnerability exists due to the xds not ensuring that the subject Alternative Name of an upstream is validated...

OpenSSL Multiple Vulnerabilities (20141015) - Linux

OpenSSL is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL Multiple Vulnerabilities (20150108 - 1) - Windows

OpenSSL is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL DoS Vulnerability (20180327) - Windows

OpenSSL is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

Zscaler Client Connector 代码问题漏洞

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A code...

WordPress Popular Posts 5.3.2 Plugin - Remote Code Execution (Authenticated) Exploit

Exploit Title: WordPress Plugin Popular Posts 5.3.2 - Remote Code Execution RCE Authenticated Exploit Author: Simone Cristofaro Vendor Homepage: https://it.wordpress.org/plugins/wordpress-popular-posts/ Software Link: https://downloads.wordpress.org/plugin/wordpress-popular-posts.5.3.2.zip Versio...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM FileNet Content Manager, IBM FileNet BPM and IBM Content Foundation products (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack affects products that use the SSL/TLS protocol as a means for secure communication. The IBM FileNet Content Manager, IBM FileNet BPM and IBM Content Foundation products can be configured to use the SSL/TLS protocol and are thus potentially affected by this...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2021-2206)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Siemens SINUMERIK Integrate Operate Client

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION : Exploitable remotely Vendor : Siemens Equipment : SINUMERIK Integrate Operate Client Vulnerability : Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to spoof any SSL server...

Security Bulletin: Security vulnerabilities affecting IBM InfoSphere Optim Performance Manager (CVE-2015-1916, CVE-2015-0488)

Summary This advisory covers all the issues disclosed by Oracle in their April 2015 Critical Patch Update CPU, plus additional CVEs which are specific to the IBM JRE/SDK. Vulnerability Details CVE-2015-1916 Description: Server applications which use the IBM Java Secure Socket Extension provider t...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM InfoSphere Optim Performance Manager (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM InfoSphere Optim Performance Manager. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker...

Security Bulletin: Multiple vulnerabilities in the IBM® Runtime Environments, Java™ Technology Edition, Version 6 affects the IBM InfoSphere Optim Data Masking Solution.

Summary There are multiple vulnerabilities in the IBM Runtime Environments, Java Technology Edition, Version 6 CVE-2015-0488, CVE-2015-2808,CVE-2015-0410, CVE-2015-1916,CVE-2015-0204 that affect the IBM InfoSphere Optim Data Masking Solution. These issues were disclosed as part of the IBM Java SD...