Alertas de Seguridad de la Información

hMailServer versiones 6.0.0 a 6.3.5 no implementa correctamente la validación DANE/TLSA para entregas SMTP salientes, permitiendo degradación a conexiones sin TLS cuando los registros DNSSEC no contienen registros DANE-EE. Esto expone las comunicaciones de correo en tránsito a empresas mexicanas y latinoamericanas que usan este servidor de correo, comprometiendo la confidencialidad de mensajes según RFC 7672.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.12 on 3.x and 2.16.1 on 2.x, the client infers that an HTTP proxy tunnel exists from the last request method rather than the CONNECT result. After a proxy rejects CONNECT, redirect or authentication handlers can write an origin request and its Authoriza…

Transmission of a sensitive key in the URL over an unencrypted HTTP connection.  The request is sent over HTTP rather than HTTPS, meaning the key is transmitted in plaintext across the network. An attacker with the ability to monitor network traffic could intercept the request and obtain the key

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle (MitM) attacks.

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information which allows an attacker to eavesdrop on with authentication credentials and sensitive data in transit. This issue affects Hitachi Coding Software Suite: through 3.3.0.