CLSA-2026-1787322589 exim: Fix of 2 CVEs

CVE-2026-66140: fix directory traversal via mishandled queue-name arguments local privilege escalation - CVE-2026-66141: fix .forward privilege escalation via mishandled forcecommand for a pipe transport...

EUVD-2017-2315

Malware in sbrugna...

EUVD-2017-2317

Malware in sbrugna...

OSCI-Transport Library 1.2 1.8.1 Insecure Crypto / Signature Bypass

A blog post with further information has been released on this topic as well: https://r.sec-consult.com/osci SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: OSCI-Transport Library 1.2...

Azure IoT SDK Spoofing Vulnerability (Sep 2018) - Windows

Azure IoT Device C SDK library is prone to a spoofing vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Spoofing

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK, C SDK, Java SDK...

CVE-2018-8119: Improper Certificate Validation

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK, C SDK, Java SDK...

PT-2018-18446

Name of the Vulnerable Software and Affected Versions Azure IoT Device Provisioning AMQP Transport library affected versions not specified Description A spoofing issue exists due to improper certificate validation over the AMQP protocol. This affects the C SDK, C SDK, and Java SDK. Recommendation...

OSCI Transport Library OSCI-Transport Signature Package Vulnerability

OSCI Transport Library Java is a Java library of mandatory transport protocols for German e-government, and OSCI Transport Library .NET is its .NET version.OSCI-Transport is one of the XML-based transport protocols. A security vulnerability exists in OSCI Transport Library version 1.6.1 Java and...

OSCI Transport Library OSCI-Transport XXE vulnerability

OSCI Transport Library Java is a Java library of mandatory transport protocols for German e-government, and OSCI Transport Library .NET is its .NET version.OSCI-Transport is one of the XML-based transport protocols. An XML external entity injection vulnerability exists in OSCI Transport Library...

OSCI Transport Library OSCI-Transport Decryption Transport Encryption Algorithm Vulnerability

OSCI Transport Library Java is a Java library of mandatory transport protocols for German e-government, and OSCI Transport Library .NET is its .NET version.OSCI-Transport is one of the XML-based transport protocols. A security vulnerability exists in OSCI Transport Library version 1.6.1 Java and ...

Design/Logic Flaw

A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET. Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the...

Xxe

An XML External Entity XXE issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET, exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure...

CVE-2017-10670

An XML External Entity XXE issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET, exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure...

CVE-2017-10668

A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET. Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the...

CVE-2017-10670

The CVE-2017-10670 entry describes an XML External Entity (XXE) vulnerability in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). The root cause is an XXE issue that can be exploited by sending a specially crafted, standards-conforming OSCI ...

CVE-2017-10669

CVE-2017-10669 describes a Signature Wrapping vulnerability in OSCI-Transport 1.2 as used by OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). An attacker who can read unencrypted OSCI protocol messages can craft messages containing duplicate IDs to exploit the flaw. Affe...

CVE-2017-10670: Improper Restriction of XML External Entity Reference

An XML External Entity XXE issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET, exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure...

CVE-2017-10669: Improper Verification of Cryptographic Signature

Signature Wrapping exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET. An attacker with access to unencrypted OSCI protocol messages must send crafted protocol messages with duplicate IDs...

CVE-2017-10668: Use of a Broken or Risky Cryptographic Algorithm

A Padding Oracle exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 Java and OSCI Transport Library 1.6 .NET. Under an MITM condition within the OSCI infrastructure, an attacker needs to send crafted protocol messages to analyse the CBC mode padding in order to decrypt the...