CVE-2013-7110

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073...

PYSEC-2014-72

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073...

CVE-2013-2073

The Connected documents confirm CVE-2013-2073 affects the Transifex command-line client, where versions before 0.9 do not validate X.509 certificates, allowing an attacker to MITM-spoof the Transifex server with an arbitrary certificate. Impact is spoofing data-transfer connections due to missing...

CVE-2014-0350

The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate...

Code injection

The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate...

CVE-2014-0350

The CVE concerns POCO C++ Libraries’ NetSSL X509Certificate::verify in Poco::Net, vulnerable before 1.4.6p4 to MITM via crafted DNS PTRs during server-name wildcard comparison. Affected product: POCO’s NetSSL in POCO C++ Libraries; root cause: weak validation of X.509 CN/SAN matching against wild...

CVE-2014-1295

Secure Transport in Apple iOS before 7.1.1, Apple OS X 10.8.x and 10.9.x through 10.9.2, and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle attackers to obtain sensitive...

CVE-2014-1295

Technical details about CVE-2014-1295 are not publicly available in the provided documents. Monitor for updates.

Viber's Poor Data Security Practices Threaten Users' Privacy

Last week we reported a critical vulnerability in the world's most popular messaging application WhatsApp, that could expose users’ GPS location data to hackers and was discovered by the researchers at UNH Cyber Forensics Research & Education Group. Same Group of researchers reported new set of...

CVE-2014-2735

WinSCP (Windows FTP client) is affected by CVE-2014-2735 due to missing validation of the server X.509 certificate hostname when using FTP over TLS. The issue allows MITM spoofing of SSL servers with an arbitrary valid certificate because the client does not verify the CN or subjectAltName. Affec...

CVE-2012-0214

The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool APT 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user fro...

CVE-2012-0214

CVE-2012-0214 affects apt (APT) 0.8.11–0.8.15.10 and 0.8.16 before 0.8.16~exp13, allowing a MITM attacker updating from InRelease-enabled repositories to trick the user into installing altered packages by keeping the old InRelease active. Impact: potential installation of arbitrary packages; no e...

Ubuntu Update for curl USN-2167-1

Check for the Version of curl OpenVAS Vulnerability Test $Id: gbubuntuUSN21671.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for curl USN-2167-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you...

Ubuntu Update for nss USN-2159-1

Check for the Version of nss OpenVAS Vulnerability Test $Id: gbubuntuUSN21591.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for nss USN-2159-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you ca...

Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : nss vulnerability (USN-2159-1)

It was discovered that NSS incorrectly handled wildcard certificates when used with internationalized domain names. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to spoof SSL servers. Note that Tenable Network Security has extracted the precedi...

Slack: TLS1/SSLv3 Renegotiation Vulnerability

URL: http://www.slack.com Vulnerability description A flaw in the design of the TLS v. 1/SSL v. 3 TLS/SSL handshake process was discovered in 2009, and RFC 5746 Feb. 2010 was released to update the protocol specification. Since then, most system manufacturers have released patches to fix this fla...

CURL-CVE-2014-0139 IP address wildcard certificate validation

libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses. RFC 2818 covers the requirements for matching Common Names CNs and subjectAltNames in order to establish valid SSL connections. It first discusses CNs that are for hostnames, and the rules for wildcards in th...

Design/Logic Flaw

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

Twitter enables StartTLS for Secure Emails to prevent Snooping

TWITTER is taking users' privacy and security very seriously and in an effort to prevent Government snooping, the company has secured your Twitter emails with with TLS Transport Layer Security. Twitter emails were previously using a plain text communication protocol, that now has been upgraded to...

Ubuntu Update for gnutls26 USN-2127-1

Check for the Version of gnutls26 OpenVAS Vulnerability Test $Id: gbubuntuUSN21271.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for gnutls26 USN-2127-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free...