#cwe-295

共收录 447 条相关情报。

漏洞预警2026-08-19 发布INFO

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP managemen...

CVE-2026-16835

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW9

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-19 发布INFO

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.v...

CVE-2026-50149

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-19 发布INFO

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat ...

CVE-2026-49283

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-19 发布INFO

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX systems due to improper validation of TLS certificates.

CVE-2026-15078

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM could allow a remote attacker to gain unauthorized access to AIX syste

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-19 发布INFO

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept f...

CVE-2026-76242

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-18 发布INFO

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs...

CVE-2026-57826

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constra

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-18 发布INFO

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, com.rabbitmq.client.ConnectionFactory.us...

CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-18 发布INFO

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration perf...

CVE-2026-52723

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-18 发布INFO

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration disa...

CVE-2026-50578

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-18 发布INFO

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.r...

CVE-2026-59825

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12,

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

安全公告2026-08-17 发布INFO

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR)...

CVE-2026-66795

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic impr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-295 #severity:critical

漏洞预警2026-08-17 发布INFO

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspe...

CVE-2026-66795

A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic impr

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-14 发布LOW

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

CVE-2026-63650

该漏洞影响 OpenVPN 2.7_alpha1 至 2.7.5 版本，且仅在使用 mbedTLS 加密库时触发。根本原因是 OpenVPN 在基于 X.509 证书进行用户身份识别时，忽略了管理员配置的“用户名身份查找字段”（即指定从证书

历史摘要 · 未重新核验 · NVD

#cve #cwe-115 #cwe-295

漏洞预警2026-08-14 发布INFO

erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify sig...

CVE-2026-49457

erlang_quic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the serve

历史摘要 · 未重新核验 · NVD

#cve #cwe-295 #cwe-297

漏洞预警2026-08-13 发布INFO

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

安全公告2026-08-13 发布INFO

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

CVE-2026-54481

Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-295

漏洞预警2026-08-13 发布INFO

rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept...

CVE-2026-70454

rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

漏洞预警2026-08-13 发布INFO

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attacker with man-in-the-middle (MitM) access to intercept and...

CVE-2026-0296

Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthenticated attac

历史摘要 · 未重新核验 · NVD

#cve #cwe-295

安全公告2026-08-12 发布INFO

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA...

CVE-2026-18679

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane co

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-295 #severity:medium

漏洞预警2026-08-12 发布INFO

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane connects with TLS peer verification disabled, and the datap...

CVE-2026-18679

When kuma-dp is started against an HTTPS control plane and the operator did not pass a CA certificate, the data plane co

历史摘要 · 未重新核验 · NVD

#cve #cwe-295