https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:09:22 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-00351 bdu:2022-00351 https://cve.radiocsirt.org/vuln/bdu:2022-00351 https://cve.radiocsirt.org/vuln/bell-cve-2021-3618 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2021-3618 https://cve.radiocsirt.org/vuln/bit-nginx-2021-3618 <p><strong>Affected:</strong> Bitnami: nginx</p> <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> <p><strong>Affected:</strong> Bitnami: nginx</p> <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> https://cve.radiocsirt.org/vuln/bit-nginx-2021-3618 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0866 certfr-2024-avi-0866 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0866 https://cve.radiocsirt.org/vuln/cleanstart-2026-em10035 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: nginx</p> <p>Package nginx version 1.20.1-r1 fixes 1 vulnerabilities: CVE-2021-3618</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: nginx</p> <p>Package nginx version 1.20.1-r1 fixes 1 vulnerabilities: CVE-2021-3618</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-em10035 https://cve.radiocsirt.org/vuln/euvd-2026-20936 EUVD-2026-20936 https://cve.radiocsirt.org/vuln/euvd-2026-20936 https://cve.radiocsirt.org/vuln/fkie_cve-2021-3618 <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-3618 https://cve.radiocsirt.org/vuln/ghsa-r9r5-jxp7-whr4 <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> https://cve.radiocsirt.org/vuln/ghsa-r9r5-jxp7-whr4 https://cve.radiocsirt.org/vuln/gsd-2021-3618 gsd-2021-3618 https://cve.radiocsirt.org/vuln/gsd-2021-3618 https://cve.radiocsirt.org/vuln/msrc_cve-2021-3618 msrc_CVE-2021-3618 https://cve.radiocsirt.org/vuln/msrc_cve-2021-3618 https://cve.radiocsirt.org/vuln/oesa-2022-1637 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: nginx, openEuler:20.03-LTS-SP3: nginx, openEuler:22.03-LTS: nginx</p> <p>NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fix(es): ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.(CVE-2021-3618)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: nginx, openEuler:20.03-LTS-SP3: nginx, openEuler:22.03-LTS: nginx</p> <p>NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server. Security Fix(es): ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.(CVE-2021-3618)</p> https://cve.radiocsirt.org/vuln/oesa-2022-1637 https://cve.radiocsirt.org/vuln/sca-2025-0009 <p>The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client&#39;s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that &#34;this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol&#34; and &#34;utimes does not fail under normal circumstances. An unauthorized access vulnerabiitly exists in all versions of Portainer, which could let a malicious user obtain sensitive information. NOTE: Portainer has received no detail of this CVE report. There is also no response after multiple attempts of contacting the original source. In ISC DHCP 4.1-ESV-R…</p> <p>The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009. A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact. The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client&#39;s download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that &#34;this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol&#34; and &#34;utimes does not fail under normal circumstances. An unauthorized access vulnerabiitly exists in all versions of Portainer, which could let a malicious user obtain sensitive information. NOTE: Portainer has received no detail of this CVE report. There is also no response after multiple attempts of contacting the original source. In ISC DHCP 4.1-ESV-R…</p> https://cve.radiocsirt.org/vuln/sca-2025-0009 https://cve.radiocsirt.org/vuln/suse-ru-2022:0655-1 <p>Recommended update for vsftpd</p> <p>Recommended update for vsftpd</p> https://cve.radiocsirt.org/vuln/suse-ru-2022:0655-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3618 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: nginx, Ubuntu:14.04:LTS: sendmail, Ubuntu:14.04:LTS: vsftpd, Ubuntu:Pro:16.04:LTS: nginx, Ubuntu:16.04:LTS: vsftpd, Ubuntu:16.04:LTS: sendmail, Ubuntu:18.04:LTS: nginx, Ubuntu:18.04:LTS: vsftpd, Ubuntu:18.04:LTS: sendmail, Ubuntu:20.04:LTS: nginx and 4 more</p> <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: nginx, Ubuntu:14.04:LTS: sendmail, Ubuntu:14.04:LTS: vsftpd, Ubuntu:Pro:16.04:LTS: nginx, Ubuntu:16.04:LTS: vsftpd, Ubuntu:16.04:LTS: sendmail, Ubuntu:18.04:LTS: nginx, Ubuntu:18.04:LTS: vsftpd, Ubuntu:18.04:LTS: sendmail, Ubuntu:20.04:LTS: nginx and 4 more</p> <p>ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim&#39;s traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-3618 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1482 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen TLS Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in verschiedenen TLS Implementierungen ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1482