CVE-2012-5819

FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-3446

Apache Libcloud before 0.11.1 suffers from an incorrect regular expression in hostname verification against the X.509 certificate’s CN/subjectAltName, allowing MITM via crafted certificates. Affected versions: Libcloud prior to 0.11.1. Root cause: faulty domain name matching logic in SSL verifica...

CVE-2012-5795

The CVE-2012-5795 issue concerns the PayPal Express module in osCommerce failing to verify that the server hostname matches a domain name in the certificate’s CN or SAN. This enables MITM-style spoofing of SSL servers using an arbitrary valid certificate. Affected component: PayPal Express integr...

CVE-2012-5800

The CVE-2012-5800 entry concerns the PrestaShop eBay module failing to verify that the server hostname matches a domain in the certificate’s CN or subjectAltName. This weakens TLS authentication and allows man-in-the-middle attackers to spoof SSL servers using an arbitrary valid certificate. The ...

CVE-2012-5803

The CVE-2012-5803 entry concerns the Authorize.Net module in Ubercart failing to verify that the server hostname matches a domain in the certificate’s CN or subjectAltName. This misconfiguration enables man-in-the-middle attackers to spoof SSL servers using arbitrary valid certificates. The descr...

CVE-2012-5807

Technical details (affected product/version, root cause, exploitability, impact, and fixes) are not provided in the connected documents. Monitor for updates.

CVE-2012-5813

The CVE-2012-5813 entry concerns the Android_Pusher library for Android where TLS hostname verification is not performed against the server certificate’s CN/subjectAltName. This omission enables man-in-the-middle attackers to spoof SSL servers using an arbitrary valid certificate. The available s...

CVE-2012-5819

FilesAnywhere is affected by a TLS hostname verification issue: the client does not verify that the server hostname matches the domain name in the certificate’s CN or subjectAltName. This allows potential MITM attackers to spoof SSL servers using an arbitrary valid certificate. The public records...

CVE-2012-5809

The CVE-2012-5809 entry describes the Groupon Redemptions Android app failing to verify that the server hostname matches the CN or subjectAltName in the server’s X.509 certificate. This weakness allows MITM attackers to spoof SSL servers using an arbitrary valid certificate. The vulnerability is ...

CVE-2012-5823

The CVE-2012-5823 issue affects Open Source Classifieds. It describes a failure to verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling man-in-the-middle attacks by spoofing SSL servers with arbitrary valid certificates, related to the PHP fsockopen fun...

CVE-2012-5817

Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, fails to verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling MITM spoofing with an arbitrary valid certificate. Impact is described as spoofing SSL s...

CVE-2012-5797

The CVE-2012-5797 entry concerns the PayPal Pro PayFlow module in osCommerce, where SSL hostname verification against the certificate’s CN/subjectAltName is not performed. This allows MITM-style spoofing of SSL servers using arbitrary valid certificates, with the reported impact described as part...

CVE-2012-5809

The Groupon Redemptions application for Android does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5790

The CVE-2012-5790 entry concerns PayPal Payments Standard PHP Library 20120427, where the library fails to verify that the server hostname matches a domain name in the certificate’s CN or SubjectAltName. This misvalidation enables man-in-the-middle attackers to spoof SSL servers using an arbitrar...

CVE-2012-5804

The CVE-2012-5804 entry concerns the CyberSource module in Ubercart, which does not verify the server hostname against the certificate’s CN or subjectAltName . This mismatch enables potential man-in-the-middle attacks by spoofing SSL servers with arbitrary valid certificates. No explicit exploit ...

CVE-2012-5781

The CVE-2012-5781 entry concerns Amazon Elastic Load Balancing API Tools failing to verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling potential MITM via an arbitrary valid certificate. The root cause is improper hostname verification, related to over...

CVE-2012-5815

The Rackspace app 2.1.5 for iOS is reported to not verify that the server hostname matches a domain in the certificate’s CN/subjectAltName, enabling man-in-the-middle via arbitrary valid certificates. According to the NVD entry, this yields partial confidentiality and partial integrity impact wit...

CVE-2012-5792

The CVE-2012-5792 entry affects the Sage Pay Direct module in osCommerce. The vulnerability arises because the module does not verify that the server hostname matches a domain name in the certificate’s CN or subjectAltName, enabling MITM attackers to spoof SSL servers using an arbitrary valid cer...

CVE-2012-5785

CVE-2012-5785 concerns Apache Axis2/Java where server hostname verification against the certificate CN/SubjectAltName is not performed, enabling MITM spoofing with any valid certificate. Connected documents confirm multiple IBM advisories and IBM BPM/TDI/IMS products affected by this Axis2 SSL is...

CVE-2012-5785

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...