Design/Logic Flaw

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-48308

CVE-2022-48308 affects Palantir Sls-logging: the component did not verify hostnames in TLS certificates due to incorrect use of the javax.net.ssl.SSLSocketFactory API. This can enable a network-position attacker to perform a man-in-the-middle attack, intercepting or altering traffic to and from t...

CVE-2022-48306

The CVE-2022-48306 vulnerability affects Palantir Gotham Chat IRC helper prior to version 30221005.210011.9242, due to improper validation of TLS hostnames. This hostname validation flaw enables a malicious actor with network access to perform a man-in-the-middle attack, potentially intercepting,...

CVE-2022-48307

The CVE-2022-48307 entry concerns Magritte-ftp where hostnames were not verified in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. This allowed a network-positioned attacker to perform a man-in-the-middle attack, intercepting and potentially reading or modifying traff...

CVE-2022-48307

It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack...

CVE-2022-48307

It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack...

CVE-2022-48306 Gotham Chat IRC help does not validate hostnames in TLS certificates

Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept...

CVE-2022-48308

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-48308

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

Lack of certificate verification when establishing secure connections with threat feed fabric connectors

...

PT-2023-13735

Name of the Vulnerable Software and Affected Versions FortiOS versions 7.2.0 through 7.2.3 FortiOS versions 7.0.0 through 7.0.7 FortiOS version 6.4 and earlier FortiOS version 6.2 and earlier FortiOS version 6.0 and earlier FortiProxy versions 7.0.0 through 7.0.6 FortiProxy version 2.0 and earlie...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

PT-2023-12920 · Unknown · Sls-Logging

Name of the Vulnerable Software and Affected Versions: sls-logging affected versions not specified Description: The issue arises from the misuse of the javax.net.ssl.SSLSocketFactory API, which fails to verify hostnames in TLS certificates. This could allow a malicious attacker in a privileged...

CVE-2022-48308: Improper Validation of Certificate with Host Mismatch

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

JSA10482 - 2011-07 Out of Cycle Security Bulletin: Multiple Products; TLS/SSL Renegotiation Vulnerability (CVE-2009-3555)

Last Modified Date Aug 24, 2026 12:34:49 AM...

SA40013 - TLS/SSL Renegotiation Vulnerability Pulse Connect Secure (PCS) (CVE-2009-3555) (Pulse Secure PSN-2009-11-573

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. The industry-wide TLS/SSL renegotiation issue CVE-2009-3555 has been found in the Pulse Connect Secure PCS device. This issue has been reported as a man in the middle MITM attack by ma...

CVE-2023-25758

Onekey Touch devices through 4.0.0 and Onekey Mini devices through 2.10.0 allow man-in-the-middle attackers to obtain the seed phase. The man-in-the-middle access can only be obtained after disassembling a device i.e., here, "man-in-the-middle" does not refer to the attacker's position on an IP...

CVE-2023-25758

CVE-2023-25758 affects Onekey Touch devices up to 4.0.0 and Onekey Mini devices up to 2.10.0. The issue allows a man-in-the-middle to obtain the seed phase, but only after disassembling the device (physical access). The vulnerability description is consistent across multiple sources, which specif...

CVE-2023-22367

Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which may allow a remote unauthenticated attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...