CVE-2014-0104

In fence-agents before 4.0.17 does not verify remote SSL certificates in the fenceciscoucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates...

EulerOS 2.0 SP8 : python-urllib3 (EulerOS-SA-2020-1028)

According to the version of the python-urllib3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS sto...

F5 Networks BIG-IP : NodeJS vulnerability (K63025104)

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the...

Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2014-3603)

Summary IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability Vulnerability Details CVEID: CVE-2014-3603 DESCRIPTION: The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do...

Dovecot 2.0.x < 2.0.16 Man In The Middle Vulnerability

Dovecot is prone to a man-in-the-middle vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

CVE-2019-6032

The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2019-6032

The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2019-6032

The CVE-2019-6032 entry affects the Android App “NTV News24” prior to Ver.3.0.0, which fails to verify SSL server certificates (CWE-295). This enables a MITM attacker to spoof servers and eavesdrop or obtain sensitive data. Affected: NTV News24 Android app (prior to 3.0.0). Root cause: improper c...

Updated 389-ds-base packages fix security vulnerabilities

he updated packages fix security vulnerabilities and a packaging problem: An out-of-bounds memory read flaw was found in the way 389-ds-base handled certain LDAP search filters, affecting all versions including 1.4.x. A remote, unauthenticated attacker could potentially use this flaw to make...

Unspecified vulnerability in wolfSSL (CNVD-2020-01645)

wolfSSL formerly known as CyaSSL is the United States wolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A security vulnerability exists in wolfSSL versions prior to 4.3.0, which can be exploited by an attacker to perform a side-channel atta...

Security Bulletin: Internal SSL Communication Vulerability in Watson Studio Local (PSIRT-ADV0011800)

Summary Watson Studio local removed support of older SSL protocol Vulnerability Details Third Party Entry: PSIRT-ADV0011800 DESCRIPTION: CVSS Base score: 7.5 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products and Versions Affected Products| Versions ---|--- IBM Watson...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Tivoli Netcool Configuration Manager (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects the IBM WebSphere Application Server Version 7 that is shipped with IBM Tivoli Netcool Configuration Manager. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could all...

Cisco ASA DoS bug attacked in wild

By Nick Biasini. Cisco Talos has recently noticed a sudden spike in exploitation attempts against a specific vulnerability in our Cisco Adaptive Security Appliance ASA and Firepower Appliance. The vulnerability, CVE-2018-0296, is a denial-of-service and information disclosure directory traversal...

Inspecting TLS Web Traffic - Part 2

In the first blog post I covered why HTTPS web traffic has grown to unprecedented levels, provided a TLS primer and looked at the basic concept of intercepting and inspecting HTTPS web traffic with Man-In-The-Middle techniques MITM. In the second part, I will dive a bit deeper into how the TLS MI...

Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Tivoli Netcool/OMNIbus (Multiple CVEs)

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Versions 5, 6, and 7 that are used by Tivoli Netcool/OMNIbus. These issues were disclosed as part of the IBM Java SDK updates in January 2015. This bulletin also addresses the “FREAK: Factoring Attack...

CVE-2019-7487

Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution...

JVN#01236065: Android App "NTV News24" fails to verify SSL server certificates

Android App "NTV News24" provided by Nippon Television Network Corporation fails to verify SSL server certificates CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to th...

EulerOS 2.0 SP3 : elinks (EulerOS-SA-2019-2574)

According to the version of the elinks package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.CVE-2012-6709 Note that Tenable Network Security has extracted the...

CVE-2019-8849

The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1. A SwiftNIO application using TLS may be able to execute arbitrary code...