ibmsecurity

IBM サンプルコード このリポジトリには、IBM セキュリティー・アプライアンスをそれぞれの REST API を使用して管理するための Python コードが含まれています。 ISAM アプライアンスのコードが最も成熟しています。 ISDS アプライアンスのコードは開発中です。 ISVG アプライアンスのコードは新しいものです（10.0.1.0 以上でのみテスト済み）。 要件 このパッケージには Python v3.9 以上が必要です。 以下の Python パッケージが必要です： 1. requests - REST API 呼び出しを行うため 2. PyYAML -...

CVE-2024-40898

CVE-2024-40898 此 Python 脚本用于检测 CVE-2024-40898，这是 Apache HTTP Server 中的一个严重漏洞，在某些错误配置下可能允许绕过 SSL/TLS 证书验证。它会向目标服务器发起 SSL 连接并发送一个 HEAD 请求。 脚本向目标服务器发起 SSL 连接并发送 HEAD 请求。如果响应表明 SSL 证书验证未正确处理，则服务器可能存在漏洞。 🚀 特性 ✅ 支持完整 URL 或纯 IP，可附带端口 ✅ 自动解析端口，未指定时默认使用 443 ✅ 忽略 SSL 证书错误（用于测试目的） ✅ 极简且快速的检测逻辑 ✅ 清晰的输出指示可能的漏...

CVE-2026-105217 Cockpit CMS 2.12.0 before 2.14.1 Disabled TLS Verification via cron.php

Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attackers to capture the worker token. Man-in-the-middle attackers on the outbound path to siteurl can present any certificate to steal the worker/web/token value an...

CVE-2026-0073-Research

CVE-2026-0073-Research CVE-2026-0073 は CVSS スコア 8.3 の RCE であり、ここではその仕組みについて説明します。 第一部 : コード分析: まず、唯一興味深い可能性があるのは、バグ自体について詳しく知ることです。 私の最初の情報源は : https://www.tenable.com/cve/CVE-2026-0073 この情報源によると、auth.cpp ファイルには adbdtlsverifycert と呼ばれる関数があり、認証されていない RCE を可能にするフローを持っています。 現在の主な目的は、auth.cpp...

CVE-2026-32794

CVE-2026-32794：Apache Airflow Databricks 提供程序中的 TLS 证书验证绕过 关键词： TLS、证书验证、MITM、Kubernetes、Databricks、OAuth、CWE-295、Apache Airflow 目录 概述 漏洞详情 技术分析 攻击链 影响 修复方案 时间线 参考资料 联系方式 免责声明 概述 apache-airflow-providers-databricks 包在与 Kubernetes API 服务器通信进行联合令牌交换时，禁用了 TLS 证书验证。同步和异步代码路径均使用 verify=False /...

gosign-desktop-exploit-poc

GoSign Desktop の複数の脆弱性によりリモートコード実行が可能 名前: GoSign Desktop の TLS 検証バイパスと安全でない更新 CVE: CVE-2025-34324、CVE-2025-34327 影響を受けるシステム: GoSign Desktop = 2.4.0 修正: FoSign Desktop 2.4.1 部分的に修正 ベンダー: Tinexta InfoCert S.p.A. 深刻度: 高 8.2/10 CVSS 3.1: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H アドバイザリ:...

Rocky Linux 9 [CIQ] Security Update: podman / podman-debuginfo / podman-debugsource / podman-docker / etc (crlsa-2025_10550)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202510550 advisory. podman: podman missing TLS verification CVE-2025-6032 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that Ness...

php: php: Server impersonation via Common Name fallback in TLS verification

A flaw was found in PHP. This vulnerability allows server impersonation and potential information disclosure during Transport Layer Security TLS connections. When verifying peer certificates, PHP improperly falls back to matching the Common Name CN if no Subject Alternative Name SAN matches the...

Security Bulletin: IBM Operator for Apache Flink is affected by Multiple Vulnerabilities

Summary IBM Operator for Apache Flink is affected by Multiple Vulnerabilities and was addressed in BM Operator for Apache Flink 1.5.5 Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname...

CVE-2026-84975 PJSIP: TLS server identity (hostname) verification bypass via embedded NUL in certificate SubjectAltName (OpenSSL and GnuTLS backends)

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the OpenSSL and GnuTLS backends in pjlib/src/pj/sslsockossl.c and pjlib/src/pj/sslsockgtls.c copy DNS SubjectAltName values with string functions that recalculate their length and truncate an...

io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration

A flaw was found in Netty io.netty:netty-handler. When using the SslProvider.OPENSSL client path with a plain X509TrustManager and without Unsafe-based trust-manager wrapping Java 25+, TLS hostname verification is disabled. This misconfiguration allows a man-in-the-middle attacker to present a...

EUVD-2026-78899

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl.createunverifiedcontext to download the second-stage pilot.tar archive without TLS certificat...

CVE-2026-52724

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-50166

Kuma (an Envoy-based service mesh) is affected in kumactl , its CLI tool. When an operator configures an HTTPS control plane profile without --ca-cert-file, kumactl disables TLS peer verification and transmits API tokens over the unverified connection. An attacker positioned on the network path c...

CVE-2026-50166 Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

EUVD-2026-78771

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724 kuma-dp connects to control plane without verifying TLS certificate when no CA is configured

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, Universal mode kuma-dp connections to an HTTPS control plane disable TLS peer verification when --ca-cert-file is not supplied and...

CVE-2026-52724

Kuma is an Envoy-based service mesh. In Universal mode , when kuma-dp connects to an HTTPS control plane without a CA certificate (--ca-cert-file unset and KUMA_CONTROL_PLANE_CA_CERT unset), TLS peer verification is disabled . An on-path attacker can intercept the dataplane authentication token, ...