58 matches found
cve-2009-3555-test-server
What is this? This is a TLS server using a vendored fork of the Go TLS stack that has renegotation indication extension forcibly disabled, which will trigger CVE-2009-3555 mitigations in OpenSSL 3.0+. Note that it isn't truly vulnerable to CVE-2009-3555 because the Go TLS stack doesn't allow...
Improper Check for Certificate Revocation
Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, whic...
Improper Check for Certificate Revocation
Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an...
CVE-2026-106069
A flaw was found in the Node.js TLS stack. When a non-canonical numeric hostname is used, hostname normalization for certificate verification can disagree with how the platform resolves the address used for the connection. This can cause checkServerIdentity to accept a certificate that does not...
CVE-2026-105483
A flaw was found in the Node.js TLS stack. Improper normalization of hostnames that use fullwidth Unicode digits to represent an IPv4 address can cause certificate hostname verification to accept a certificate that does not identify the intended peer. This may allow an attacker who can influence...
CVE-2026-73252
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...
EUVD-2026-101596
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...
CVE-2026-73252: Integer Underflow (Wrap or Wraparound)
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MGTLSBUILTIN in src/tlsbuiltin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no plaintext or ContentType byte. In mgtlsrecvrecord, the msgsz...
CVE-2026-73253
A flaw was found in Mongoose. Wildcard certificate matching in its built-in Transport Layer Security TLS stack does not properly restrict matches to a single domain level. An on-path network attacker with a valid wildcard certificate for a parent domain could exploit this flaw to bypass hostname...
golang-fips: Golang FIPS zeroed buffer
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
EUVD-2017-11927
Malware in sbrugna...
EUVD-2024-2916
Malicious code in bioql PyPI...
Alibaba Cloud Linux 3 : 0224: go-toolset:rhel8 (ALINUX3-SA-2024:0224)
The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0224 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2024-9355: A vulnerability was found in Golang...
Linux Distros Unpatched Vulnerability : CVE-2024-9355
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buff...
golang-fips: Golang FIPS zeroed buffer
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
golang-fips: Golang FIPS zeroed buffer
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
GHSA-3H3X-2HWV-HR52 Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
CVE-2024-9355
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...
CVE-2024-9355
A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...