CVE-2023-29175

CVE-2023-29175 describes an improper certificate validation vulnerability (CWE-295) in FortiOS and FortiProxy that could enable remote, unauthenticated attackers to perform a Man-in-the-Middle attack on the link between affected devices and FortiGuard’s map server. Affected products/versions incl...

Lack of certificate verification when establishing secure connections

...

Fedora 37 : curl (2023-8ed627bb04)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8ed627bb04 advisory. - fix more POST-after-PUT confusion CVE-2023-28322 - fix IDN wildcard match CVE-2023-28321 Tenable has extracted the preceding description block...

Fedora 38 : curl (2023-37eac50e9b)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-37eac50e9b advisory. - fix more POST-after-PUT confusion CVE-2023-28322 - fix IDN wildcard match CVE-2023-28321 Tenable has extracted the preceding description block...

Schweitzer Engineering Laboratories RTAC Improper Certificate Validation (CVE-2023-31151)

An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote unauthenticated attacker to conduct a man-in-the-middle MitM attack. See SEL Service Bulletin dated 2022-11-15 for more details...

CVE-2023-28321

CVE-2023-28321 affects curl before 8.1.0, where a private wildcard matching function used for TLS SAN wildcard patterns can mis-match IDN hostnames. IDNs are punycode-encoded (starting with xn--), but the curl wildcard check could still accept patterns like x* that should not match, potentially a...

SUSE SLES12 Security Update : curl (SUSE-SU-2023:2225-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2225-1 advisory. This update for curl adds the following feature: Update to version 8.0.1 jscPED-2580 - CVE-2023-28319: use-after-free in SSH sha256...

SUSE SLED15: curl / libcurl-devel / libcurl-devel-32bit / libcurl4 / etc (SUSE-SU-2023:2224-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2224-1 advisory. This update for curl adds the following feature: Update to version 8.0.1 jscPED-2580 -...

SUSE SLES15 Security Update : curl (SUSE-SU-2023:2227-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2227-1 advisory. - CVE-2023-28320: Fixed siglongjmp race condition bsc1211231. - CVE-2023-28321: Fixed IDN wildcard matching bsc1211232. -...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current curl Multiple Vulnerabilities (SSA:2023-137-01)

The version of curl installed on the remote host is prior to 8.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2023-137-01 advisory. - A use after free vulnerability exists in curl v8.1.0 in the way libcurl offers a feature to verify an SSH server's public key...

F5 BIG-IP Edge Client Windows Component Installer < 7.2.4.1 Improper Certificate Validation (K000132539)

The version of the Big-IP Edge Client Windows Component Installer installed on the remote Windows host is before 7.2.4.1. An improper certificate validation vulnerability exists in BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system. CVE-2023-2446...

CVE-2023-31151 Improper Certificate Validation

An Improper Certificate Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote unauthenticated attacker to conduct a man-in-the-middle MitM attack. See SEL Service Bulletin dated 2022-11-15 for more details...

CVE-2023-24461 BIG-IP Edge Client for Windows and macOS vulnerability

An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Improper Certificate Validation

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to missing SSL Certificate Validation. Note: The vendor does not consider this a vulnerability because the report is only about use of certificates at th...

Debian: Security Advisory (DLA-3368-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3368-1] libreoffice security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3368-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucaries March 26, 2023 https://wiki.debian.org/LTS -...

CVE-2021-21548

CVE-2021-21548 affects Dell EMC Unisphere for PowerMax family: PowerMax OS Release 5978, and Unisphere for PowerMax/Virtual Appliance releases prior to 9.1.0.27. The flaw is improper certificate validation in TLS, allowing an unauthenticated remote attacker to mount a man-in-the-middle attack by ...

CVE-2022-4895 Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer

Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux Analytics probe component, Hitachi Ops Center Analyzer on Linux Analyzer probe component allows Man in the Middle Attack.This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00...

CVE-2022-4895 Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer

Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux Analytics probe component, Hitachi Ops Center Analyzer on Linux Analyzer probe component allows Man in the Middle Attack.This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00...

Security Bulletin: Certifi package as used by IBM QRadar User Behavior Analytics is vulnerable to improper certificate validation (CVE-2022-23491)

Summary The Certifi package as used by IBM QRadar User Behavior Analytics is vulnerable to improper certificate validation. This package has been updated in the latest release and the vulnerability has been addressed. Please follow the instructions in the Remediation/Fixes section below to update...