Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 50

Export CSV
CVE-2013-5606

nss: CERT_VerifyCert returns SECSuccess (saying certificate is good) even for bad certificates (MFSA 2013-103)

The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate.

CVSS 2.0 · 5.8 Medium EPSS 2.4% KEV · Not listed
Vendors
Mozilla Redhat
Products
Network Security Services Enterprise Linux
CVE-2022-3479

nss: nss client auth crash without a user certificate in the database

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mozilla
Products
Network Security Services
CVE-2020-25648

nss: TLS 1.3 CCS flood remote DoS Attack

A flaw was found in the way NSS handled CCS (ChangeCipherSpec) messages in TLS 1.3. This flaw allows a remote attacker to send multiple CCS messages, causing a denial of service for servers compiled with the NSS library. The highest threat from this vulnerability is to system availability. This flaw affects NSS versions before 3.58.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Fedoraproject Mozilla Oracle and 1 more
Products
Fedora Network Security Services Communications Offline Mediation Controller and 4 more
CVE-2019-17006

nss: Check length of inputs for cryptographic primitives

In Network Security Services (NSS) before 3.46, several cryptographic primitives had missing length checks. In cases where the application calling the library did not perform a sanity check on the inputs it could result in a crash due to a buffer overflow.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Mozilla Netapp Redhat and 1 more
Products
Network Security Services Hci Compute Node Hci Management Node and 24 more
CVE-2018-12404

nss: Cache side-channel variant of the Bleichenbacher attack

A cached side channel attack during handshakes using RSA encryption could allow for the decryption of encrypted content. This is a variant of the Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) and affects all NSS versions prior to NSS 3.41.

CVSS 3.0 · 5.9 Medium EPSS 44.2% KEV · Not listed
Vendors
Mozilla Redhat
Products
Network Security Services Ansible Tower Enterprise Linux
CVE-2018-12384

nss: ServerHello.random is all zeros when handling a v2-compatible ClientHello

When handling a SSLv2-compatible ClientHello request, the server doesn't generate a new random value but sends an all-zero value instead. This results in full malleability of the ClientHello for SSLv2 used for TLS 1.2 in all versions prior to NSS 3.39. This does not impact TLS 1.3.

CVSS 3.0 · 5.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Mozilla Redhat
Products
Network Security Services Enterprise Linux
CVE-2016-9574

nss: Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA

nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.

CVSS 3.0 · 5.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Mozilla
Products
Network Security Services