bmcweb

Веб-сервер OpenBMC Этот компонент представляет собой попытку создать универсальный "делающий всё" встроенный веб-сервер для OpenBMC. Возможности Веб-сервер реализует несколько отдельных интерфейсов: Веб-сокет событий DBus. Позволяет регистрироваться для отслеживания изменений определённых путей и...

CVE-2026-0073-Android-ADBD-bypass-POC_zh_CN

CVE-2026-0073 — Обход аутентификации TLS ADBD Android EVPPKEYcmp путаница типов → неавторизованная ADB-оболочка 🔥 Обзор В демоне ADB Android adbd обнаружена критическая уязвимость обхода аутентификации , позволяющая любому атакующему в локальной сети получить полный доступ к оболочке на целевом...

adbHijacker

CVE-2026-0073 — Обход аутентификации TLS в Android ADB Эксплойт proof-of-concept и сетевой сканер для CVE-2026-0073 — критической уязвимости удалённого выполнения кода с нулевым кликом и без взаимодействия в пути аутентификации ADB-over-TCP в Android adbd. Уязвимость представляет собой логическую...

Security Bulletin: IBM Documentation Offline may be vulnerable to TLS authentication bypass and authority rebinding due to Node.js (CVE-2026-48618, CVE-2026-48930)

Summary IBM Documentation Offline uses Node.js as its runtime environment. Node.js is affected by two vulnerabilities related to TLS hostname handling. CVE-2026-48618 involves improper handling of Unicode dot separators during TLS certificate verification, which could allow an attacker performing...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

EUVD-2026-84936

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

CVE-2026-18173

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

CVE-2026-18173 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

CVE-2026-18173

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is affected by CVE-2026-18173 , which allows a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication . The vulnerability is categorized under CWE-295: Improper Certificate Validation . ...

CVE-2026-18173 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: etcd (UTSA-2022-001268)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2022-001268 advisory. In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS...

OESA-2026-3643 freerdp security update

FreeRDP is a client implementation of the Remote Desktop Protocol RDP that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp. Security Fixes: FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname...

OESA-2026-3644 freerdp security update

FreeRDP is a client implementation of the Remote Desktop Protocol RDP that follows Microsoft's open specifications. This package provides the client applications xfreerdp and wlfreerdp. Security Fixes: FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname...

CVE-2026-80904

CVE-2026-80904 is a Linux kernel vulnerability in the net/tls (TLS offload) subsystem. When an asynchronous TLS decryption fails, tls_sw_recvmsg() and tls_sw_read_sock() correctly check async_wait.err and abort the read, but tls_sw_splice_read() performs no such check. As a result, a splice opera...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freerdp (UTSA-2026-106202)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106202 advisory. FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in...

JLSEC-2026-1347 aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers...

aria2c accepts a server certificate with incorrect Extended Key Usage EKU. If the attackers compromise a certificate with the associated private key issued for a different purpose, they may be able to reuse it for TLS server authentication...

PT-2026-80784

Name of the Vulnerable Software and Affected Versions redis versions prior to 8.10.1-1.1 Description Multiple security issues affect the redis package, which is an open source, in-memory database that persists data on disk. Recommendations Update to version 8.10.1-1.1...

CVE-2026-67294

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67294 FreeRDP before 3.29.0 TLS Certificate EKU Bypass

FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...