CVE-2024-25630 Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who are using CRDs to store Cilium state the default configuration and Wireguard transparent encryption, traffic to/from the Ingress and health endpoints is not encrypted. This issue affect...

Cilium Security Vulnerabilities

Cilium is an open source software. It is used to provide and transparently secure network connectivity and load balancing between application workloads such as application containers or processes. A security vulnerability exists in versions prior to Cilium v1.14.7 that stems from traffic to and...

PT-2024-21051 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.14 through 1.14.6 Description: The issue affects Cilium users who have enabled an external kvstore and Wireguard transparent encryption, resulting in unencrypted traffic between pods in the affected cluster. Recommendations:...

DEBIAN-CVE-2023-50257

eProsima Fast DDS formerly Fast RTPS is a C++ implementation of the Data Distribution Service standard of the Object Management Group. Even with the application of SROS2, due to the issue where the data pUD and guid values used to disconnect between nodes are not encrypted, a vulnerability has be...

CVE-2023-50257

CVE-2023-50257 affects eProsima Fast DDS (Fast RTPS) with SROS2. The issue: RTPS Disconnect packets (p[UD]/guid) are not encrypted, enabling a malicious actor to forcibly disconnect a Subscriber and deny connections by sending disconnect packets to 239.255.0.1:7400 using the Publisher ID. Impact ...

PT-2024-13889

Name of the Vulnerable Software and Affected Versions eProsima Fast DDS versions prior to 2.13.0 eProsima Fast DDS versions prior to 2.12.2 eProsima Fast DDS versions prior to 2.11.3 eProsima Fast DDS versions prior to 2.10.3 eProsima Fast DDS versions prior to 2.6.7 Description A vulnerability h...

The vulnerability of the PEAP (Protected Extensible Authentication Protocol) client implementation of the Wi-Fi Protected Access Point software WPA Supplicant allows a hacker to intercept the unencrypted user traffic.

The vulnerability of the PEAP Protected Extensible Authentication Protocol client Wi-Fi access control implementation, such as WPA Supplicant, arises due to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to intercept unencrypted user traffic by...

The vulnerability of the Android application for controlling TP-Link Tapo C200 IP cameras, which involves unencrypted storage of user credentials, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Android application for controlling TP-Link Tapo C200 IP cameras lies in the unencrypted storage of user credentials. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the protected information...

GLSA-202402-21 : QtNetwork: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202402-21 QtNetwork: Multiple Vulnerabilities - An issue was discovered in Qt before 5.15.14, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1. Qt Network incorrectly parses the strict-transport-security HSTS header, allowin...

Marvin Attack

Overview Affected versions of this package are vulnerable to Marvin Attack due to the improper handling of DTLS records that do not check if messages span key boundaries. An attacker can exploit this vulnerability to combine DTLS messages using different keys into one DTLS record. Notes: 1 An...

CVE-2023-6937

wolfSSL prior to 5.6.6 did not check that messages in one DTLS record do not span key boundaries. As a result, it was possible to combine DTLS messages using different keys into one DTLS record. The most extreme edge case is that, in DTLS 1.3, it was possible that an unencrypted DTLS 1.3 record...

CVE-2023-4537

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects ERP XL: from 2020.2.2 through 2023.2...

CVE-2023-4537

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects ERP XL: from 2020.2.2 through 2023.2...

Design/Logic Flaw

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects ERP XL: from 2020.2.2 through 2023.2...

CVE-2023-4537

CVE-2023-4537 affects Comarch ERP XL client (ERP XL: 2020.2.2–2023.2). The issue is a server‑side MS SQL protocol downgrade that can lead to unencrypted communication vulnerable to data interception and modification. The available documents confirm the affected software and the root cause (downgr...

CVE-2023-4537 Protocol Downgrade in Comarch ERP XL

Comarch ERP XL client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affects ERP XL: from 2020.2.2 through 2023.2...

Comarch ERP XL Security Vulnerability

Comarch ERP XL is an enterprise resource planning ERP software from Comarch Poland. A security vulnerability exists in Comarch ERP XL versions 2020.2.2 through 2023.2, which stems from susceptibility to server-side MS SQL protocol downgrade requests and may result in unencrypted communications th...

PT-2024-2258 · Unknown · Trace Mode 7

Name of the Vulnerable Software and Affected Versions: TRACE MODE 7 affected versions not specified Description: The issue is related to the storage of confidential information in unencrypted form in memory. Exploitation of this issue could allow an attacker to gain unauthorized access to protect...

PT-2024-13241

Name of the Vulnerable Software and Affected Versions Comarch ERP XL versions 2020.2.2 through 2023.2 Description The Comarch ERP XL client is vulnerable to an MS SQL protocol downgrade request from the server side, which could lead to unencrypted communication. This makes the communication...

The vulnerability of the XWiki Platform, a platform for creating collaborative web applications, lies in the unencrypted storage of critical information, which allows attackers to disclose protected data.

The vulnerability of the XWiki Platform lies in the unencrypted storage of critical information. Exploiting this vulnerability could allow a malicious actor to disclose the protected data remotely...