WebLogic SSL Certificate Chain User Spoofing

The remote web server is running WebLogic. There is a bug in this version that could allow an attacker to perform a man-in-the-middle attack against the remote server by supplying a self-signed certificate. An attacker with a legitimate certificate could use this flaw to impersonate any other use...

Sambar Server Cleartext Password Transmission

The remote Sambar server allows users to log in without using SSL. A man-in-the-middle attacker can exploit this to capture the passwords of the users of this server. The attacker can then use these to access the web mail accounts and modify the web pages on behalf of the users of the system. C...

CVE-2002-1471

The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate, which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack...

CVE-2002-1471

The camel component for Ximian Evolution 1.0.x and earlier does not verify certificates when it establishes a new SSL connection after previously verifying a certificate, which could allow remote attackers to monitor or modify sessions via a man-in-the-middle attack...

CVE-2002-1407

TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack...

OpenSSL < 0.9.6j / 0.9.7b Multiple Vulnerabilities

According to its banner, the remote host is using a version of OpenSSL older than 0.9.6j or 0.9.7b. This version is vulnerable to a timing-based attack that could allow an attacker to guess the content of fixed data blocks and may eventually be able to guess the value of the private RSA key of th...

CVE-2002-1955

Iomega NAS A300U uses cleartext LANMAN authentication when mounting CIFS/SMB drives, which allows remote attackers to perform a man-in-the-middle attack...

CVE-2002-2125

Internet Explorer 6.0 does not warn users when an expired certificate authority CA certificate is submitted to the user and a newer CA certificate is in the user's local repository, which could allow remote attackers to decrypt web sessions via a man-in-the-middle MITM attack...

CVE-2002-0862

The 1 CertGetCertificateChain, 2 CertVerifyCertificateChainPolicy, and 3 WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints ...

CVE-2002-1106

Cisco Virtual Private Network VPN Client software 2.x.x, and 3.x before 3.5.1C, does not properly verify that certificate DN fields match those of the certificate from the VPN Concentrator, which allows remote attackers to conduct man-in-the-middle attacks...

CVE-2002-0970

The SSL capability for Konqueror in KDE 3.0.2 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack...

CVE-2002-0978

Microsoft File Transfer Manager FTM ActiveX control before 4.0 allows remote attackers to upload or download arbitrary files to arbitrary locations via a man-in-the-middle attack with modified TGT and TGN parameters in a call to the "Persist" function...

CVE-2002-0862

The 1 CertGetCertificateChain, 2 CertVerifyCertificateChainPolicy, and 3 WinVerifyTrust APIs within the CryptoAPI for Microsoft products including Microsoft Windows 98 through XP, Office for Mac, Internet Explorer for Mac, and Outlook Express for Mac, do not properly verify the Basic Constraints ...

CVE-2002-0978

Microsoft File Transfer Manager FTM ActiveX control before 4.0 allows remote attackers to upload or download arbitrary files to arbitrary locations via a man-in-the-middle attack with modified TGT and TGN parameters in a call to the "Persist" function...

KDE Security Advisory: Konqueror SSL vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 KDE Security Advisory: Konqueror SSL vulnerability Original Release Date: 2002-08-18 URL: http://www.kde.org/info/security/advisory-20020818-1.txt 0. References http://online.securityfocus.com/archive/1/286290/2002-07-31/2002-08-06/0...

IE SSL Vulnerability

======================================================================== Internet Explorer SSL Vulnerability 08/05/02 Mike Benham [email protected] http://www.thoughtcrime.org ======================================================================== Abstract Internet Explorer's implementation...

Microsoft Internet Explorer 56 Konqueror 2.2.23.0 Weblogic Server 567 - Invalid X.509 Certificate Chain

Microsoft Internet Explorer 56 Konqueror 2.2.23.0 Weblogic Server 567 - Invalid X.509 Certificate Chain source: https://www.securityfocus.com/bid/5410/info A flaw has been reported in the handling of X.509 certificates by a number of products, including several web browsers. It may be possible fo...

Microsoft Internet Explorer 5/6 / Konqueror 2.2.2/3.0 / Weblogic Server 5/6/7 - Invalid X.509 Certificate Chain

source: https://www.securityfocus.com/bid/5410/info A flaw has been reported in the handling of X.509 certificates by a number of products, including several web browsers. It may be possible for a malicious party to create certificates for arbitrary domains, which will be treated as trusted by th...

Remote Desktop Protocol Service Detection

The Remote Desktop Protocol allows a user to remotely obtain a graphical login and therefore act as a local user on the remote host. If an attacker gains a valid login and password, this service could be used to gain further access on the remote host. An attacker may also use this service to moun...

Citrix Server Detection

Citrix servers allow a Windows user to remotely obtain a graphical login and therefore act as a local user on the remote host. NOTE: by default the Citrix Server application utilizes a weak 40 bit obfuscation algorithm not even a true encryption. If the default settings have not been changed, the...