CVE-2014-0160

CVE-2014-0160 مختبر بناء مختبر باستخدام Heartbleed لتسريب ذاكرة تطبيقات الويب يركز هذا المستودع على بناء حاوية لإنشاء بيئة سهلة لاستغلال nginx باستخدام تقنية Heartbleed مع التركيز على: بناء البيئة باستخدام Docker مخطط إعداد الخادم خطوات العرض التوضيحي مخطط الخادم تظهر مشكلة CVE-2014-0160 عندما تو...

python: Use-after-free of a server-side SSLContext when sni_callback switches contexts

A flaw was found in Python. A remote, unauthenticated TLS client can cause a use-after-free in a server that uses SSLContext.snicallback to assign a different SSLSocket.context when selecting a certificate per server name, if nothing else keeps the original SSLContext alive. This can crash the...

CLEANSTART-2026-JQ32755 Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments

Security vulnerability affects the spark package. Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments...

SUSE SLES15: libtcnative-1-0 / libtcnative-1-0-devel / tomcat / etc (SUSE-SU-2026:4546-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4546-1 advisory. Security issues fixed: libtcnative-1-0: - CVE-2026-86243: buffer overread during the TLS handshake permits a malicious user to...

PT-2026-107437

Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TL...

PT-2026-107624

Name of the Vulnerable Software and Affected Versions Docker Engine versions prior to 29.8.2 Moby versions prior to 2.0.0-beta.25 Description Docker Engine classifies a registry hostname as insecure using an any-match DNS check. The loadInsecureRegistries function injects 127.0.0.0/8 and ::1/128 ...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1791413715)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791413715 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context...

MiracleLinux 9 : nodejs:24 (AXSA:2026-1984:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1984:01 advisory. undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation CVE-2026-85152 undici: undici: TLS certificat...

cve-2026-105221-gist-tls

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · cve-2026-105221-gist-tls cve-2026-105221-gist-tls gist RubyGem 6.1.0 - defunkt httpconnection устанавливает OpenSSL::SSL::VERIFYNONE. HTTPS до GitHub всё ещё шифрует трафик, но принимается любой сертификат. Узел на...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-80852

A flaw was found in the Linux kernel's TLS device driver. A local attacker could exploit an out-of-bounds write vulnerability in the tlsappendfrag function when handling TLSTXZEROCOPYRO with spliceSPLICEFMORE operations. This flaw allows an attacker to cause memory corruption, leading to a denial...

Security Bulletin:Improper Certificate Validation in Erlang OTP public_key: DNS NameConstraints Bypass in TLS Hostname Verification

Summary Improper Certificate Validation vulnerability in Erlang OTP publickey pubkeycert and publickey modules allows a DNS nameConstraints bypass via subject CommonName fallback in TLS hostname verification. Two flaws combine to allow a subordinate CA whose DNS nameConstraints are restricted e.g...

Security Bulletin:Netty Vulnerability: IndexOutOfBoundsException in SslClientHelloHandler Leading to Mutual TLS Bypass

Summary Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records c...

CVE-2026-106105 Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

CVE-2026-106105 Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0, the @quasar/ssl-certificate utility cached a combined private key and certificate PEM without explicitly applying owner-only...

CVE-2026-106105

The Quasar Framework contains a vulnerability where the @quasar/ssl-certificate utility caches combined private keys and certificates without applying owner-only filesystem permissions . This occurs in versions prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0....

DNS-Poisoning-Triage-Lab

Laboratoire de tri du trafic DNS et ARP Un exercice pédagogique d'analyse de paquets et de durcissement de résolveur réalisé sur une station de travail Arch Linux. Portée : Ce dépôt est un projet d'apprentissage. La capture incluse est utile pour s'entraîner à l'inspection DNS et ARP, mais elle n...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

CVE-2026-79551-Tenda

CVE-2026-79551 Clé privée TLS codée en dur Tenda ID CNVD : CNVD-2026-25884 Fournisseur : Tenda Technology Co., Ltd. Produit : Enregistreur vidéo réseau NVR4H version matérielle CH3V2.1 Micrologiciel : V27.5.58.6 Classe : CWE-321 — Utilisation d'une clé cryptographique codée en dur Aperçu Le...