PT-2012-2216

Name of the Vulnerable Software and Affected Versions CiviCRM versions 4.0.5 and 4.1.1 Description The issue arises from the failure to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. This allows...

DEBIAN-CVE-2012-3446

Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted...

PYSEC-2012-17

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library...

UBUNTU-CVE-2012-5825

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library...

CVE-2012-5784

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

[Burp Suite] Free Edition v1.5

Burp Suite helps you secure your web applications by finding the vulnerabilities they contain. Burp Suite is an integrated platform for attacking web applications. It contains all of the Burp tools with numerous interfaces between them designed to facilitate and speed up the process of attacking ...

PT-2012-6128

Name of the Vulnerable Software and Affected Versions AOL Instant Messenger AIM version 1.0.1.2 Description The issue arises from the failure to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. This allows...

CVE-2012-5796: Improper Input Validation

The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

phpMyAdmin 3.5.x < 3.5.3 Multiple Vulnerabilities (PMASA-2012-6 - PMASA-2012-7)

According to its self-identified version number, the phpMyAdmin 3.5.x install hosted on the remote web server is earlier than 3.5.3 and is, therefore, affected by multiple vulnerabilities : - When creating or modifying a trigger, event, or procedure with a crafted name, it is possible for a user ...

CVE-2012-4511

services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2011-4129

1 services/twitter/twitter-contact-view.c and 2 services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

Code injection

services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2011-4129

CVE-2011-4129 affects libsocialweb b4 0.25.20, specifically the Twitter integration in twitter-contact-view.c and twitter-item-view.c. The code automatically connects to Twitter when no Twitter account is configured, which could enable a remote attacker to obtain sensitive information via a man-i...

CVE-2012-4511

CVE-2012-4511 affects libsocialweb prior to 0.25.21, where the library creates an untrusted connection to Flickr when no Flickr account is configured. This behavior can enable a man‑in‑the‑middle (MITM) attacker to access sensitive information or alter data, as described in multiple advisories. F...

CVE-2012-4511

Removed by vendor...

CVE-2011-4129

Removed by vendor...

PT-2012-1807

Name of the Vulnerable Software and Affected Versions libsocialweb versions prior to 0.25.20 Description The issue allows remote attackers to potentially obtain sensitive information via a man-in-the-middle MITM attack. This occurs because certain components in libsocialweb automatically connect ...

PT-2012-5451

Name of the Vulnerable Software and Affected Versions libsocialweb versions prior to 0.25.21 Description The issue allows remote attackers to potentially obtain sensitive information via a man-in-the-middle MITM attack. This occurs because the services/flickr/flickr.c component in libsocialweb...

CVE-2012-4511: Exposure of Sensitive Information to an Unauthorized Actor

services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

MitM-vulnerability in Palo Alto Networks GlobalProtect

--------------------------------------------------------------------- SySS-Advisory: MitM-vulnerability in Palo Alto Networks GlobalProtect --------------------------------------------------------------------- Problem discovered: July 12th 2012 Vendor contacted: July 13th 2012 Advisory published:...