CVE-2012-5810

The CVE describes a TLS hostname verification flaw in the Chase mobile banking app for Android: the app does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling MITM with arbitrary certificates. Root cause cited as overriding the default X509TrustM...

CVE-2012-5792

The CVE-2012-5792 entry affects the Sage Pay Direct module in osCommerce. The vulnerability arises because the module does not verify that the server hostname matches a domain name in the certificate’s CN or subjectAltName, enabling MITM attackers to spoof SSL servers using an arbitrary valid cer...

CVE-2012-5783

Apache Commons HttpClient 3.x (as used in Amazon FPS Java SDK and related products) is affected by CVE-2012-5783: the code does not verify that the server hostname matches the CN/subjectAltName in the X.509 certificate, enabling potential MITM spoofing with arbitrary certificates. AIX advisories,...

CVE-2012-5808

CVE-2012-5808 – Zen Cart LinkPoint module vulnerability. The issue is that the LinkPoint module does not verify that the server hostname matches a domain name in the certificate’s CN or subjectAltName, enabling MITM attackers to spoof SSL servers using arbitrary valid certificates. Documented acr...

CVE-2012-5799

The CVE-2012-5799 issue affects the Canada Post module in PrestaShop, where the code path using PHP fsockopen does not verify that the server hostname matches a domain listed in the certificate’s Common Name (CN) or subjectAltName. This enables potential MITM spoofing of SSL servers using arbitra...

CVE-2012-5800

The eBay module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Design/Logic Flaw

1 services/twitter/twitter-contact-view.c and 2 services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2012-4511

services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2011-4129

1 services/twitter/twitter-contact-view.c and 2 services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

Man-in-the-middle Vulnerability in GlobalProtect App

A vulnerability exists in NetConnect all version and GlobalPortect App 1.1.6 and earlier whereby the agent does not verify the certificate presented by the portal server, enabling a possible Man-in-the-middle attack. This vulnerability can result in an agent connecting to an attacker-controlled...

USN-1583-1: Ruby vulnerabilities

It was discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions. CVE-2011-1005 John Firebaugh discovered that the RubyGems remote gem fetcher did not properly verify SSL certificates...

CVE-2012-2125 CVE-2012-2126 rubygems: Two security fixes in v1.8.23

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

CVE-2012-2993

Microsoft Windows Phone 7 is affected: it does not verify the domain name in the server certificate’s Common Name, enabling MITM spoofing for SSL connections over POP3/IMAP/SMTP with arbitrary valid certificates. Affected software is Windows Phone 7; vulnerable component is certificate CN verific...

Design/Logic Flaw

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differenc...

Flawed EMV Chip-and-PIN Protocol Paves Way To Fraudulent ATM and POS Transactions

A flaw in the EMV protocol which lays out the rules for chip-and-PIN card transactions at ATMs and point-of-sale terminals could enable persistent attackers to carry out bogus card transactions. Five Cambridge UK University researchers released a paper today with the gory details. Foremost among...

Slackware: Security Advisory (SSA:2009-014-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-1547-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[USN-1547-1] libGData, evolution-data-server vulnerability

========================================================================== Ubuntu Security Notice USN-1547-1 August 28, 2012 libgdata, evolution-data-server vulnerability ========================================================================== A security issue affects these releases of Ubuntu a...

FreeBSD Ports: fetchmail

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2012-1177

libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle MITM attack with a spoofed certificate...