Most recent entries from all

cnvd-2016-07565

EUVD-2026-86636

fkie_cve-2016-7444

The gnutls_ocsp_resp_check_crt function in lib/x509/ocsp.c in GnuTLS before 3.4.15 and 3.5.x before 3.5.4 does not verify the serial length of an OCSP response, which might allow remote attackers to bypass an intended certificate validation mechanism via vectors involving trailing bytes left by gnutls_malloc.

GHSA-3ccg-r3xv-q4cg

gsd-2016-7444

ICSA-19-155-01 — PHOENIX CONTACT PLCNext AXC F 2152

A remote attacker can exploit a server 's private key by sending carefully constructed UserIdentityTokens encrypted with the Basic128Rsa15 security policy. This could allow an attacker to decrypt passwords even if encrypted with another security policy such as Basic256Sha256. CVE-2018-7559 has been assigned to this vulnerability. A CVSS v3 base score of 7.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L). An attacker with physical access to the device can manipulate SD card data, which could allow an attacker to bypass the authentication of the device. This device is designed for use in a protected industrial environment with restricted physical access.CVE-2019-10998 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). An attacker trying to connect to the device using a man-in-the-middle setup may crash the PLC service, resulting in a denial of service condition. The device must then be rebooted, or the PLC service must be restarted manually via Linux shell.CVE-2019-10997 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly ha…

RHSA-2017:2292 — Red Hat Security Advisory: gnutls security, bug fix, and enhancement update

gnutls: Incorrect certificate validation when using OCSP responses (GNUTLS-SA-2016-3) gnutls: Double-free while decoding crafted X.509 certificates gnutls: Out of memory while parsing crafted OpenPGP certificate gnutls: Stack overflow in cdk_pk_get_keyid gnutls: Heap read overflow in read-packet.c gnutls: Crash upon receiving well-formed status_request extension gnutls: Out-of-bounds write related to the cdk_pkt_read function (GNUTLS-SA-2017-3)

SUSE-SU-2017:0348-1 — Security update for gnutls

Security update for gnutls

UBUNTU-CVE-2016-7444

Affected: Ubuntu:16.04:LTS: gnutls28

VDE-2019-009 — PHOENIX CONTACT: Multiple Vulnerabilities in AXC F 2152

Multiple vulnerabilities have been identified in PHOENIX CONTACT AXC F 2152 with firmware versions 1.x