Apache::Session::LDAP 信任管理问题漏洞

Apache::Session::LDAP is a tool for storing Apache sessions in LDAP. A security vulnerability exists in Apache::Session::LDAP versions prior to 0.5 that stems from not checking the validity of an X.509 certificate...

Apache::Session::Browseable 信任管理问题漏洞

Apache::Session::Browseable is an Apache::Session implementation that allows indexes to be defined to speed up searches. A security vulnerability exists in Apache::Session::Browseable versions prior to 1.3.6 that stems from not checking the validity of X.509 certificates...

November 8, 2022—KB5020009 (Monthly Rollup)

None None...

November 8, 2022—KB5020003 (Security-only update)

None None...

pyload 信任管理问题漏洞

pyload is a free and open source download manager written in Python, designed to be extremely lightweight, easily extensible and fully manageable over the web. A trust management issue vulnerability exists in versions prior to pyload 0.5.0b3.dev44, which stems from incorrect validation of...

多款Baicells Nova产品信任管理问题漏洞

Baicells Nova 227 is a miniature base station.Baicells Nova 233 is a miniature base station.Baicells Nova 243 is a miniature base station. A trust management issue vulnerability exists in the Baicells Nova 227, Nova 233, and Nova 243 LTE TDD eNodeB device firmware prior to RTS/RTD 3.7.11.6. The...

Attacking The Supply Chain: Developer

In this proof of concept, we look into one of several attack vectors that can be abused to attack the supply chain: targeting the developer. With a focus on the local integrated developer environment IDE, this proof considers the execution of malicious build scripts via injecting commands when th...

SUSE SLES15: libfreebl3 / libfreebl3-32bit / libfreebl3-hmac / etc (SUSE-SU-2023:0130-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0130-1 advisory. - CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but t...

Siemens S7-1500 CPU devices Missing Immutable Root of Trust in Hardware (CVE-2022-38773)

Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot image of the device and execute arbitrary cod...

SUSE-SU-2023:0130-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: - CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored bsc1204272. - Updated to version 3.79.3 bsc1207038: - CVE-2022-23491:...

Amazon Linux AMI : postgresql95 (ALAS-2023-1660)

The version of postgresql95 installed on the remote host is prior to 9.5.24-1.83. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1660 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Medium: postgresql93

Issue Overview: When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of SSL certificate verification and...

Amazon Linux AMI : postgresql94 (ALAS-2023-1659)

The version of postgresql94 installed on the remote host is prior to 9.4.26-1.78. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1659 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

Amazon Linux AMI : postgresql96 (ALAS-2023-1661)

The version of postgresql96 installed on the remote host is prior to 9.6.24-1.86. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1661 advisory. When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a...

SaaS Security Posture Management (SSPM) as a Layer in Your Identity Fabric

The move to SaaS and other cloud tools has put an emphasis on Identity & Access Management IAM. After all, user identity is one of the only barriers standing between sensitive corporate data and any unauthorized access. The tools used to define IAM make up its identity fabric. The stronger the...

SUSE-SU-2023:0119-1 Security update for mozilla-nss

This update for mozilla-nss fixes the following issues: - CVE-2022-3479: Fixed a potential crash that could be triggered when a server requested a client authentication certificate, but the client had no certificates stored bsc1204272. - Updated to version 3.79.3 bsc1207038: - CVE-2022-23491:...

Insecure Permissions

org.keycloak:keycloak-parent is vulnerable to Insecure Permissions. An attacker is able to shadow other users with the same email and impersonate or lockout the victim due to the email trust not being handled correctly...

Dell EMC Storage信任管理问题漏洞

A security vulnerability exists in Dell EMC Storage, a data storage solution from Dell, U.S.A. The vulnerability stems from incorrect certificate revocation checks. An attacker could use the vulnerability to perform a man-in-the-middle attack and eavesdrop on encrypted communications from a cloud...

GHSA-VHVQ-JH34-3FC8 Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c7xw-p58w-h6fj. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled...

Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c7xw-p58w-h6fj. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled...