[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnLSegLEGDhjgXkrN6y7EpC131b_VwmGP9lhM7q2EmUA":3,"g5a-ex:stormshield\u002Fstormshield_management_center@*":95,"g5a-family:stormshield\u002Fstormshield_management_center":97},{"success":4,"data":5},true,{"product":6,"versions":26,"topVulnerabilitiesByEpss":32,"kevVulnerabilities":72,"seoMetadata":73,"meta":92},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":25},"stormshield","stormshield_management_center",5,8,0,"2023-02-08",[14,17,19,21,23],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},"3.2.2",false,{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},"3.3.0",{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},"3.3.1",{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},"3.3.2",{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},"3.3.3","Stormshield Management Center by Stormshield is a technology product with 5 tracked versions and 8 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[27,28,29,30,31],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},[33,41,47,51,55,61,65,69],{"cveId":34,"description":35,"publishedDate":36,"cvssScore":37,"cvssVersion":38,"severity":39,"isKev":16,"epssScore":40},"CVE-2022-32214","The llhttp parser \u003Cv14.20.1, \u003Cv16.17.1 and \u003Cv18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).","2022-07-14",6.5,"v3.1","Medium",0.81832,{"cveId":42,"description":43,"publishedDate":12,"cvssScore":44,"cvssVersion":38,"severity":45,"isKev":16,"epssScore":46},"CVE-2023-0286","There is a type confusion vulnerability relating to X.400 address processing\ninside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but\nthe public structure definition for GENERAL_NAME incorrectly specified the type\nof the x400Address field as ASN1_TYPE. This field is subsequently interpreted by\nthe OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an\nASN1_STRING.\n\nWhen CRL checking is enabled (i.e. the application sets the\nX509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass\narbitrary pointers to a memcmp call, enabling them to read memory contents or\nenact a denial of service. In most cases, the attack requires the attacker to\nprovide both the certificate chain and CRL, neither of which need to have a\nvalid signature. If the attacker only controls one of these inputs, the other\ninput must already contain an X.400 address as a CRL distribution point, which\nis uncommon. As such, this vulnerability is most likely to only affect\napplications which have implemented their own functionality for retrieving CRLs\nover a network.",7.4,"High",0.71239,{"cveId":48,"description":49,"publishedDate":36,"cvssScore":37,"cvssVersion":38,"severity":39,"isKev":16,"epssScore":50},"CVE-2022-32215","The llhttp parser \u003Cv14.20.1, \u003Cv16.17.1 and \u003Cv18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).",0.70244,{"cveId":52,"description":53,"publishedDate":36,"cvssScore":37,"cvssVersion":38,"severity":39,"isKev":16,"epssScore":54},"CVE-2022-32213","The llhttp parser \u003Cv14.20.1, \u003Cv16.17.1 and \u003Cv18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).",0.45956,{"cveId":56,"description":57,"publishedDate":58,"cvssScore":59,"cvssVersion":38,"severity":45,"isKev":16,"epssScore":60},"CVE-2002-20001","The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that are actually not public keys, and trigger expensive server-side DHE modular-exponentiation calculations, aka a D(HE)at or D(HE)ater attack. The client needs very little CPU resources and network bandwidth. The attack may be more disruptive in cases where a client can require a server to select its largest supported key size. The basic attack scenario is that the client must claim that it can only communicate with DHE, and the server must be configured to allow DHE.","2021-11-11",7.5,0.24639,{"cveId":62,"description":63,"publishedDate":12,"cvssScore":59,"cvssVersion":38,"severity":45,"isKev":16,"epssScore":64},"CVE-2023-0215","The public API function BIO_new_NDEF is a helper function used for streaming\nASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the\nSMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by\nend user applications.\n\nThe function receives a BIO from the caller, prepends a new BIO_f_asn1 filter\nBIO onto the front of it to form a BIO chain, and then returns the new head of\nthe BIO chain to the caller. Under certain conditions, for example if a CMS\nrecipient public key is invalid, the new filter BIO is freed and the function\nreturns a NULL result indicating a failure. However, in this case, the BIO chain\nis not properly cleaned up and the BIO passed by the caller still retains\ninternal pointers to the previously freed filter BIO. If the caller then goes on\nto call BIO_pop() on the BIO then a use-after-free will occur. This will most\nlikely result in a crash.\n\n\n\nThis scenario occurs directly in the internal function B64_write_ASN1() which\nmay cause BIO_new_NDEF() to be called and will subsequently call BIO_pop() on\nthe BIO. This internal function is in turn called by the public API functions\nPEM_write_bio_ASN1_stream, PEM_write_bio_CMS_stream, PEM_write_bio_PKCS7_stream,\nSMIME_write_ASN1, SMIME_write_CMS and SMIME_write_PKCS7.\n\nOther public API functions that may be impacted by this include\ni2d_ASN1_bio_stream, BIO_new_CMS, BIO_new_PKCS7, i2d_CMS_bio_stream and\ni2d_PKCS7_bio_stream.\n\nThe OpenSSL cms and smime command line applications are similarly affected.",0.05024,{"cveId":66,"description":67,"publishedDate":12,"cvssScore":59,"cvssVersion":38,"severity":45,"isKev":16,"epssScore":68},"CVE-2023-0216","An invalid pointer dereference on read can be triggered when an\napplication tries to load malformed PKCS7 data with the\nd2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions.\n\nThe result of the dereference is an application crash which could\nlead to a denial of service attack. The TLS implementation in OpenSSL\ndoes not call this function however third party applications might\ncall these functions on untrusted data.",0.01846,{"cveId":70,"description":71,"publishedDate":12,"cvssScore":59,"cvssVersion":38,"severity":45,"isKev":16,"epssScore":68},"CVE-2023-0401","A NULL pointer can be dereferenced when signatures are being\nverified on PKCS7 signed or signedAndEnveloped data. In case the hash\nalgorithm used for the signature is known to the OpenSSL library but\nthe implementation of the hash algorithm is not available the digest\ninitialization will fail. There is a missing check for the return\nvalue from the initialization function which later leads to invalid\nusage of the digest API most likely leading to a crash.\n\nThe unavailability of an algorithm can be caused by using FIPS\nenabled configuration of providers or more commonly by not loading\nthe legacy provider.\n\nPKCS7 data is processed by the SMIME library calls and also by the\ntime stamp (TS) library calls. The TLS implementation in OpenSSL does\nnot call these functions however third party applications would be\naffected if they call these functions to verify signatures on untrusted\ndata.",[],{"title":74,"metaDescription":75,"keywords":76,"structuredData":77},"Stormshield Management Center by Stormshield - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Stormshield Management Center by Stormshield covering 5 versions with 8 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Stormshield Management Center vulnerabilities, Stormshield Management Center security, Stormshield Management Center CVE, Stormshield Stormshield Management Center, Stormshield Management Center threat intelligence, Stormshield security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":78,"@type":79,"name":80,"description":75,"url":81,"manufacturer":82,"applicationCategory":86,"softwareVersion":87,"mainEntity":88},"https:\u002F\u002Fschema.org","SoftwareApplication","Stormshield Management Center","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fstormshield\u002Fstormshield_management_center",{"@type":83,"name":84,"url":85},"Organization","Stormshield","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fstormshield","Security Software","5 versions tracked",{"@type":89,"name":90,"description":91,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Stormshield Management Center Security Vulnerabilities","Security vulnerabilities affecting Stormshield Management Center by Stormshield",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":93,"apiVersion":94},"2026-10-17T13:28:05.816Z","3.0",{"rows":96,"total":11,"capped":16,"failed":11},[],[]]