Monthly
Unauthenticated remote attackers can bypass client-certificate trust in Temporal's s2s-proxy 0.1.16 through 0.2.2 by presenting a self-signed certificate and key to a mux or TCP TLS server listener, because the proxy runs Go's RequireAnyClientCert mode whenever skipCAVerification is false and therefore never validates the presented chain against the configured CA. A successful handshake yields a yamux-multiplexed, peer-authenticated channel on which the attacker can call every RPC the proxy's aclPolicy allows, exercising the proxy's own Temporal credentials against the cross-cluster replication API without supplying any trusted certificate, private key, or Temporal credential. No CISA KEV active-exploitation signal is present and no public exploit identified at time of analysis, but the defect carries a 9.3 CVSS 4.0 score and the vendor has published an upstream fix (PR #296 plus associated commits).
Local privilege escalation in Slate Digital Connect 1.37.0 for macOS allows unprivileged users to execute commands as root by connecting to the privileged XPC helper service with a self-signed certificate whose subject OU matches the expected value. The flaw stems from improper certificate validation (CWE-296) in the helper's client authorization logic, which fails to verify the certificate chains to a trusted code-signing authority. No public exploit is identified in CISA KEV at time of analysis, and EPSS reflects very low (0.01%) near-term exploitation probability, but a detailed vendor-lab advisory is publicly available.
Arbitrary file overwrite leading to remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) via the web-based management interface. An authenticated attacker with high privileges can abuse improper input validation in the certificate download function's file path parameter to overwrite arbitrary files and ultimately execute commands as a privileged OS user. There is no public exploit identified at time of analysis, EPSS is low (0.10%, 27th percentile), and CISA SSVC records no known exploitation.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Revoked root certificates embedded in multiple Seiko Epson printers and scanners expose device communications to interception via man-in-the-middle attacks. Affected products continue to trust certificates that have been revoked, violating the chain-of-trust model defined by CWE-296, and allowing a suitably positioned attacker to decrypt or read transmitted data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity required for network positioning limits real-world exposure, but confidentiality of printer/scanner communications - potentially including scanned document content - is at risk.
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Unauthenticated remote attackers can bypass client-certificate trust in Temporal's s2s-proxy 0.1.16 through 0.2.2 by presenting a self-signed certificate and key to a mux or TCP TLS server listener, because the proxy runs Go's RequireAnyClientCert mode whenever skipCAVerification is false and therefore never validates the presented chain against the configured CA. A successful handshake yields a yamux-multiplexed, peer-authenticated channel on which the attacker can call every RPC the proxy's aclPolicy allows, exercising the proxy's own Temporal credentials against the cross-cluster replication API without supplying any trusted certificate, private key, or Temporal credential. No CISA KEV active-exploitation signal is present and no public exploit identified at time of analysis, but the defect carries a 9.3 CVSS 4.0 score and the vendor has published an upstream fix (PR #296 plus associated commits).
Local privilege escalation in Slate Digital Connect 1.37.0 for macOS allows unprivileged users to execute commands as root by connecting to the privileged XPC helper service with a self-signed certificate whose subject OU matches the expected value. The flaw stems from improper certificate validation (CWE-296) in the helper's client authorization logic, which fails to verify the certificate chains to a trusted code-signing authority. No public exploit is identified in CISA KEV at time of analysis, and EPSS reflects very low (0.01%) near-term exploitation probability, but a detailed vendor-lab advisory is publicly available.
Arbitrary file overwrite leading to remote code execution affects HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) via the web-based management interface. An authenticated attacker with high privileges can abuse improper input validation in the certificate download function's file path parameter to overwrite arbitrary files and ultimately execute commands as a privileged OS user. There is no public exploit identified at time of analysis, EPSS is low (0.10%, 27th percentile), and CISA SSVC records no known exploitation.
Certificate chain validation bypass in Juniper Junos OS J-Web on SRX Series enables person-in-the-middle attackers to intercept Security Director cloud communications, exposing credentials and sensitive data. All SRX devices connecting to SD cloud fail to properly verify server certificates, allowing interception of authentication material and configuration data. Affects Junos OS versions across all branches prior to 22.4R3-S9, 23.2R2-S6, 23.4R2-S7, 24.2R2-S3, 24.4R2-S2, and 25.2R1-S2/25.2R2. No public exploit identified at time of analysis. Network-positioned attacker with high complexity required (CVSS AC:H).
Revoked root certificates embedded in multiple Seiko Epson printers and scanners expose device communications to interception via man-in-the-middle attacks. Affected products continue to trust certificates that have been revoked, violating the chain-of-trust model defined by CWE-296, and allowing a suitably positioned attacker to decrypt or read transmitted data. No active exploitation has been confirmed (no CISA KEV listing), and the high attack complexity required for network positioning limits real-world exposure, but confidentiality of printer/scanner communications - potentially including scanned document content - is at risk.
Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.