Most recent entries from all

bdu:2015-04270

certa-2009-avi-482 — Une vulnérabilité dans le protocole SSL/TLS permet à une personne malintentionnée de contourner la politique de sécurit…

certa-2009-avi-482

EUVD-2026-322082

fkie_cve-2009-3555

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.

GHSA-f7w7-6pjc-wwm6 — Apache Tomcat affected by vulnerability in TLS and SSL protocol

Affected: Maven: org.apache.tomcat:tomcat

Apache Tomcat was affected by this issue and introduced a workaround in versions 7.0.10, 6.0.32, and 5.5.33.

gsd-2009-3555

ICSA-22-160-01 — Mitsubishi Electric Air Conditioning Systems

Use of a broken or risky cryptographic algorithm allows a remote unauthenticated attacker to cause a disclosure of an encrypted message from the air conditioning systems by sniffing encrypted communications.CVE-2022-24296 has been assigned to this vulnerability. A CVSS v3 base score of 3.1 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N). The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately 4 billion blocks. This which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode (a.k.a. a Sweet32 attack).CVE-2016-2183 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases that make it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions using the same plaintext.CVE-2013-2566 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). This vulnerability makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a st…

jvndb-2011-001632

When using SSL on the Hitachi Web Server, it could allow an attacker to insert arbitrary data on the top of communication data.

openSUSE-SU-2024:10071-1 — MozillaFirefox-50.1.0-1.1 on GA media

MozillaFirefox-50.1.0-1.1 on GA media

RHSA-2009:1579 — Red Hat Security Advisory: httpd security update

httpd: NULL pointer defer in mod_proxy_ftp caused by crafted EPSV and PASV reply httpd: mod_proxy_ftp FTP command injection via Authorization HTTP header TLS: MITM attacks via session renegotiation