CVE-2021-27876

CVE-2021-27876 استغلال تنفيذ أوامر عن بُعد غير مصادق عليه لوكيل Veritas Backup Exec CVE-2021-27876/77/78 — تجاوز مصادقة SHA إلى SYSTEM عبر NDMP الثغرات CVE| الوصف| CVSS 3.1 ---|---|--- CVE-2021-27876| تجاوز المصادقة عبر التلاعب بتجزئة SHA في بروتوكول NDMP| 9.8 حرجة CVE-2021-27877| قراءة ملفات...

explain-my-curl

explain-my-curl explain-my-curl هي أداة CLI محلية أولاً لفهم ما يفعله أمر curl عبر DNS وTLS وHTTP. يتضمن هذا المستودع حاليًا: أمر CLI لتحليل وشرح إدخال curl TUI ابتدائية للاستكشاف التفاعلي قياس عن بعد للتنفيذ لـ DNS واتصال TCP ومصافحة TLS والوقت حتى أول بايت تنقية الأسرار لعرض الأوامر وسلاسل...

cve-2021-34558

POC pour CVE-2021-34558 root@kitploit: Run the malicious TLS server go run main.go -mode server Run a normal http.Get client call against the server which panics go run main.go -mode client Une modification mineure a été apportée à ./vendor/github.com/refraction-networking/utls/handshakeserver.go...

CVE-2014-3466_PoC

Preuve de concept pour CVE-2014-3466 dépassement de tampon GnuTLS : vérification de la longueur de l'identifiant de session Informations Voir : https://bugzilla.redhat.com/showbug.cgi?id=1101932 Ceci n'est pas un exploit militarisé. Attention : ce code python est moche, j'ai pour ainsi dire...

secret_handshake

Secret Handshake - قناة C2 للبرمجيات الخبيثة تستخدم شهادات x509 عبر mTLS الدافع أولًا، لماذا سأجعل هذا المشروع مفتوح المصدر؟ لا يتحدث MITRE ATT&CK إلا عن الشهادات المسروقة أو الموقعة ذاتيًا، وتمنح أنظمة كشف الشبكة والاستجابة NDRs على حد علمي اهتمامًا ضئيلًا جدًا بمحتوى شهادات x509 بخلاف الجهة...

CVE-2026-57163

PJSIP , a multimedia communication library written in C, contains a stack buffer overflow in its GnuTLS backend (tls_cert_get_info() in ssl_sock_gtls.c) triggered when parsing the Subject Alternative Name extension of a peer certificate. An incorrect buffer-size value causes an oversized entry to...

CVE-2026-84964

CVE-2026-84964 is a double free vulnerability in the MongoDB C Driver , specifically in its OpenSSL-based TLS certificate revocation checking path . During a TLS handshake, specially formed certificate data from a crafted multi-URL certificate can cause the same heap object to be released twice. ...

POC-CVE-2026-0073

POC-CVE-2026-0073 تجاوز مصادقة ADB — إثبات المفهوم إثبات مفهوم لأبحاث أمنية بواسطة naheeju إشعار أمني: تم تصحيح CVE-2026-0073 اعتبارًا من 2026-05-01. يتم توفير إثبات المفهوم هذا حصريًا لأغراض البحث الأمني، وتحليل الثغرات، والاختبار المصرح به للأنظمة المتأثرة. جدول المحتويات إخلاء المسؤولية نظرة...

CVE-2026-8932

🚨 CVE-2026-8932 - أقدم ثغرة أمنية في libcurl عدم تطابق تكوين mTLS غير كامل في libcurl أقدم ثغرة أمنية تم إصلاحها على الإطلاق في libcurl—ظلت دون ملاحظة لأكثر من 25 عامًا. 📖 نظرة عامة CVE-2026-8932 هو ثغرة أمنية في libcurl حيث قد تعيد المكتبة استخدام اتصال TLS موجود بشكل غير صحيح بعد تغيير إعدادات...

Amazon Linux 2 : golang, --advisory ALAS2-2026-3893 (ALAS-2026-3893)

The version of golang installed on the remote host is prior to 1.26.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3893 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

EUVD-2026-67934

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the initial-handshake process. An attacker can intercept and obtain database credentials by performing a man-in-the-middle attack during the authentication exchange when the connection is...

CVE-2026-81518 BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

BI Connector Optional Client Certificate Verification Allows Unauthenticated Connections

When mongosqld is configured with a client certificate authority file, the listener requests a client certificate during the TLS handshake but does not require one, so a client that presents no certificate is still accepted. In deployments that rely on client certificates as the sole means of...

CVE-2026-81518

mongosqld in the MongoDB BI Connector contains a TLS misconfiguration: when a client certificate authority file is configured, the listener requests a client certificate during the TLS handshake but does not require it. In deployments where client certificates serve as the sole authentication mec...

EUVD-2026-67309

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

CVE-2026-18717

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

PT-2026-83237

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions 3.3.0 through 3.3.2 MariaDB Connector/Node.js versions 3.4.0 through 3.4.5 MariaDB Connector/Node.js versions 3.5.0 through 3.5.2 Description When SSL is...

CVE-2026-18717 Improper Certificate Validation in ASE 2000

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

CVE-2026-18717

ASE2000 versions 2.35 through 2.37 (by ASE Systems) contain an improper certificate validation vulnerability in the TLS implementation. An attacker with network access may impersonate a trusted peer, complete the TLS handshake, and read or modify protected communications. The CISA ICS advisory ra...