ST
Vendor
Stunnel
12
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2021-20230 | ST Stunnel Stunnel | 7.5 | Feb 23 | A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options |
| CVE-2015-3644 | ST Stunnel Stunnel | – | May 14 | Stunnel 5.00 through 5.13, when using the redirect option, does not redirect client connections to the expected server after the initial connection, which allows remote attackers… |
| CVE-2014-0016 | ST Stunnel Stunnel | – | Mar 24 | stunnel before 5.00, when using fork threading, does not properly update the state of the OpenSSL pseudo-random number generator (PRNG), which causes subsequent children with the… |
| CVE-2013-1762 | ST Stunnel Stunnel | – | Mar 8 | stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers… |
| CVE-2011-2940 | ST Stunnel Stunnel | – | Aug 25 | stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors |
| CVE-2008-2420 | ST Stunnel Stunnel | – | May 23 | The OCSP functionality in stunnel before 4.24 does not properly search certificate revocation lists (CRL), which allows remote attackers to bypass intended access restrictions by… |
| CVE-2008-2400 | ST Stunnel Stunnel | – | May 22 | Unspecified vulnerability in stunnel before 4.23, when running as a service on Windows, allows local users to gain privileges via unknown attack vectors |
| CVE-2003-0740 | ST Stunnel Stunnel | – | Oct 20 | Stunnel 4.00, and 3.24 and earlier, leaks a privileged file descriptor returned by listen(), which allows local users to hijack the Stunnel server |
| CVE-2002-1563 | ST Stunnel Stunnel | – | May 12 | stunnel 4.0.3 and earlier allows attackers to cause a denial of service (crash) via SIGCHLD signal handler race conditions that cause an inconsistency in the child counter |
| CVE-2003-0147 | ST Stunnel Stunnel | – | Mar 31 | OpenSSL does not use RSA blinding by default, which allows local and remote attackers to obtain the server's private key by determining factors using timing differences on (1) the… |
| CVE-2002-0002 | ST Stunnel Stunnel | – | Jan 31 | Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to execute arbitrary code |
| CVE-2001-0060 | ST Stunnel Stunnel | – | Feb 12 | Format string vulnerability in stunnel 3.8 and earlier allows attackers to execute arbitrary commands via a malformed ident username |