Exploit for Detection of Error Condition Without Action in Openbsd Openssh

CVE-2025-26465 The OpenSSH client contains a logic error betw...

Security update for openssh

This update for openssh fixes the following issues: CVE-2025-26465: Fixed MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client bsc1237040. CVE-2025-26466: Fixed DoS attack against OpenSSH's client and server bsc1237041. Patch Instructions: To install this SUSE update use the SUSE...

SUSE CVE-2025-26465

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. Fo...

Security Bulletin: IBM Db2 used by IBM Security Verify Governance - Container has multiple vulnerabilities

Summary IBM Security Verify Governance ISVG - Container uses IBM Db2. Information about security vulnerabilities affecting IBM Db2 has been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

UBUNTU-CVE-2025-26465

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. Fo...

IBM Security Verify Access Information Disclosure Vulnerability (CNVD-2025-06210)

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

IBM Security Verify Access Cross-Site Request Forgery Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

IBM Security Verify Access Cross-Site Scripting Vulnerability (CNVD-2025-06213)

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

IBM Security Verify Access Authorization Issues Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

OpenSSL SSL_VERIFY_PEER Man-in-the-Middle

The vulnerability of the SSL-VerifyPEER mode in the OpenSSL cryptographic library is related to the absence of a mechanism to notify the user of the establishment of a connection session. Exploiting this vulnerability allows a malicious actor to execute a “man-in-the-middle” attack during a...

IBM Security Verify Access Docker Access Management Flaw

The vulnerability of the Docker-based application access control software, IBM Security Verify Access, lies in the lack of necessary authentication during password changes. Exploiting this vulnerability allows an attacker to remotely change a user’s password...

Activitypub-Federation verify_url_valid() XSS

The vulnerability of the verifyurlvalid function in the Activitypub-Federation framework, a platform for creating and managing communities in the Lemmy community, is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow an attacker to bypass...

Hickory DNS DNSSEC Bypass Unauthorized Access

The vulnerability of the verifydnskeyrrset function in the Hickory DNS client formerly Trust-DNS is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected informati...

AZL-56885 CVE-2025-25204 affecting package gh for versions less than 2.62.0-6

gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...

PT-2025-7058

Name of the Vulnerable Software and Affected Versions: gh versions 2.49.0 through 2.66.x Description: A bug in GitHub's Artifact Attestation CLI tool, gh attestation verify, causes it to return a zero exit status when no attestations are present, under certain conditions. This behavior is...

CVE-2025-25204: Detection of Error Condition Without Action

gh is GitHub’s official command line tool. Starting in version 2.49.0 and prior to version 2.67.0, under certain conditions, a bug in GitHub's Artifact Attestation cli tool gh attestation verify causes it to return a zero exit status when no attestations are present. This behavior is incorrect:...

GitHub CLI 安全漏洞

GitHub CLI is the GitHub CLI open source for GitHub on the command line. A security vulnerability exists in GitHub CLI versions prior to 2.49.0 through 2.67.0, which stems from the gh attestation verify tool returning an error in status, which could lead an attacker to deploy malicious artifacts...

SUSE CVE-2024-12797

Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...

requests: subsequent requests to the same host ignore cert verification

An incorrect control flow implementation vulnerability was found in Requests. If the first request in a session is made with verify=False, all subsequent requests to the same host will continue to ignore cert verification...

AZL-78591 CVE-2024-12797 affecting package openssl-fips-provider 3.1.2-2

Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...