49 matches found
RLSA-2026:69126 Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...
curl security update
An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...
Important: Red Hat Security Advisory: curl security update
An update for curl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
Important: curl security update
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: libcurl: Unauthorized connection reuse due to a logical error CVE-2026-8458 curl: Information disclosure due to...
CVE-2025-36041
CVE-2025-36041 IBM MQ SSL 绕过利用工具 概述 本仓库包含针对 CVE-2025-36041 的概念验证（PoC）利用代码，该漏洞存在于 IBM MQ（消息队列）中，允许绕过 SSL 证书验证。通过注入伪造的 SSL 证书并使用定制的 MQCONNX 参数，可以建立未经授权的客户端与 IBM MQ 服务器的连接。 功能 SSL 绕过 ：注入伪造的 SSL KeyRepository 以禁用服务器证书验证。 自动化利用 ：打开指定队列并发送测试消息（"Hello MQ"）以确认利用成功。 可定制 ：通过命令行参数指定目标队列管理器、队列名称以及伪造 SSL 仓库的路...
OpenClaw has an unspecified vulnerability
OpenClaw is openclaw open source an intelligent artificial assistant. A security vulnerability exists in versions prior to OpenClaw 2026.1.29, which originates from automatically establishing a WebSocket connection and sending a token, and can be exploited by an attacker to cause an unauthorized...
EUVD-2023-49453
Malicious code in bioql PyPI...
EUVD-2025-6711
Malicious code in bioql PyPI...
NewStart CGSL MAIN 7.02 : bluez Vulnerability (NS-SA-2025-0149)
The remote NewStart CGSL host, running version MAIN 7.02, has bluez packages installed that are affected by a vulnerability: - Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports,...
Exploit for Improper Certificate Validation in Ibm Mq_Operator
CVE-2025-36041 IBM MQ SSL Bypass Exploit Overview This re...
CVE-2023-24459
A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL...
CVE-2022-28144
Jenkins Proxmox Plugin 0.7.0 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified host using attacker-specified username and password perform a connection test, disable SSL/TLS validation for...
CVE-2024-55968
An issue was discovered in DTEX DEC-M DTEX Forwarder 6.1.1. The com.dtexsystems.helper service, responsible for handling privileged operations within the macOS DTEX Event Forwarder agent, fails to implement critical client validation during XPC interprocess communication IPC. Specifically, the...
redis: possible bypass of Unix socket permissions on startup
A flaw was found in Redis, an in-memory database that persists on disk. On startup, Redis listens on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, anothe...
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Impact Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow, https://github.com/aws/aws-cdk/blob/d16482fc8a4a3e1f62751f481b770c09034df7d2/packages/%40aws-cdk/custom-resource-handlers/lib/aws-iam/oidc-handler/external.tsL34...
CVE-2025-23206 IAM OIDC custom resource allows connection to unauthorized OIDC provider in aws-cdk
The AWS Cloud Development Kit AWS CDK is an open-source software development framework to define cloud infrastructure in code and provision it through AWS CloudFormation. Users who use IAM OIDC custom resource provider package will download CA Thumbprints as part of the custom resource workflow...
redis: possible bypass of Unix socket permissions on startup
A flaw was found in Redis, an in-memory database that persists on disk. On startup, Redis listens on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, anothe...
ROS-20240916-08
Vulnerability of MongoDB database management system is related to errors in TLS certificate validation procedure. of TLS certificate authentication. Exploitation of the vulnerability could allow an attacker acting remotely, establish an unauthorized connection to the MongoDB server...
BIT-VALKEY-2023-45145 Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...
Sony: 明確な認証不備および潜在的な中間者攻撃の可能性（Clear Authentication Deficiencies & Potential for Man-in-the-Middle Attacks）
The WH-1000XM5 headphones were found to have an authentication vulnerability that allowed an attacker to connect to the device without going through the proper pairing process. This vulnerability could be combined with existing Bluetooth attacks to enable man-in-the-middle attacks...