FreeBSD : go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters (c365536d-e3cf-11eb-9d8d-b37b683944c2)

The Go project reports : crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server...

go -- crypto/tls: clients can panic when provided a certificate of the wrong type for the negotiated parameters

The Go project reports: crypto/tls clients can panic when provided a certificate of the wrong type for the negotiated parameters. net/http clients performing HTTPS requests are also affected. The panic can be triggered by an attacker in a privileged network position without access to the server...

Security Bulletin: Vulnerability in RC4 stream cipher affects GPFS V3.5 for Windows (CVE-2015-2808) / Enabling weak cipher suites for IBM General Parallel File System is NOT recommended

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects OpenSSH for GPFS V3.5 for Windows. Additionally, with the recent attention to RC4 “Bar Mitzvah” Attack for SSL/TLS, this is a reminder to NOT enable weak or export-level cipher suites for IBM General Parallel File System GPFS. Vulnerability...

SUSE: Security Advisory (SUSE-SU-2016:0748-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: TLS padding vulnerability affects Informix Client Software Development Kit (CSDK) ( CVE-2014-8730)

Summary Informix Client Software Development Kit CSDK can be affected by a TLS Transport Layer Security padding vulnerability which can allow a remote attacker to obtain sensitive information. Vulnerability Details The following vulnerability affects IBM Informix Client Software Development Kit...

Security Bulletin: TLS padding vulnerability affects Informix Dynamic Server ( CVE-2014-8730)

Summary IBM Informix Dynamic Server can be affected by a TLS Transport Layer Security padding vulnerability which can allow a remote attacker to obtain sensitive information. Vulnerability Details The following vulnerability affects IBM Informix Dynamic Server. CVEID: CVE-2014-8730 DESCRIPTION: I...

CVE-2018-16499

The CVE-2018-16499 entry concerns Versa Networks Versa VOS. The connected records indicate the issue stems from the use of unapproved SSH encryption protocols or cipher suites, enabling a network-endpoint attacker to perform a man-in-the-middle attack and potentially view communications between a...

Versa VOS 加密问题漏洞

Versa Networks VOS is an operating system from Versa Networks, USA. The highly flexible VOS enables enterprises, organizations and service providers to deploy Versa SASE in branch offices, clouds, campuses and data centers. A security vulnerability exists in Versa VOS that stems from the use of...

[SECURITY] Fedora 34 Update: gtk4-4.1.2-1.fc34

GTK is a multi-platform toolkit for creating graphical user interfaces. Offering a complete set of widgets, GTK is suitable for projects ranging from small one-off tools to complete application suites. This package contains version 4 of GTK...

Security Bulletin: Datacap Taskmaster Capture is affected by vulnerable to AppScan's SSLv3 Client Hello with CBC cipher suites that contain TLS_FALLBACK_SCSV

Summary The server responded with a Handshake to AppScan's SSLv3 Client Hello with CBC cipher suites that contain TLSFALLBACKSCSV Vulnerability Details CVEID: CVE-2014-3566 DESCRIPTION: Multiple products could allow a remote attacker to obtain sensitive information, caused by a design error when...

The vulnerability of Microsoft Excel spreadsheet editors, Microsoft Office software packages, and Microsoft 365 apps, as well as Microsoft Office Web Apps and Office Online Server, stems from insufficient validation of input data. This allows attackers to execute arbitrary code.

The vulnerability of Microsoft Excel spreadsheet editors, Microsoft Office software packages, Microsoft 365 apps, Microsoft Office Web Apps, and Office Online Server is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2021-25763

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default...

CVE-2021-25763

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default...

CVE-2021-25763

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default...

Default credentials

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default...

CVE-2021-25763

CVE-2021-25763 affects JetBrains Ktor prior to 1.4.2, where weak cipher suites were enabled by default in the framework. The issue is described as a default configuration flaw in Ktor’s crypto settings, potentially enabling weaker ciphers for connections. Public reports confirm the vulnerable ver...

CVE-2021-25763

In JetBrains Ktor before 1.4.2, weak cipher suites were enabled by default...

NSA Releases Guidance on Eliminating Obsolete TLS Protocol Configurations

The National Security Agency NSA has released a Cybersecurity Information CSI sheet on eliminating obsolete Transport Layer Security TLS configurations. The information sheet identifies strategies to detect obsolete cipher suites and key exchange mechanisms, discusses recommended TLS...

Security Bulletin: Datacap Taskmaster Capture is affected by vulnerable to weak cipher suites by successfully creating SSL connections

Summary AppScan determined that the site uses weak cipher suites by successfully creating SSL connections using each of the weak cipher suites listed here. Vulnerability Details Third Party Entry: PSIRT-ADV0026310 DESCRIPTION: Created from Advisory: ADV0026310 CVSS Base score: 5.9 CVSS Vector:...

Code injection

TLS-RSA cipher suites are not disabled in HCL BigFix Inventory up to v10.0.2. If TLS 2.0 and secure ciphers are not enabled then an attacker can passively record traffic and later decrypt it...