Design/Logic Flaw

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501

CVE-2017-11501 affects NixOS 17.03 and earlier via the users.ldap PAM module used for LDAP authentication. When TLS is used to connect to the LDAP server (users.ldap.useTLS), the peer certificate verification is unconditionally disabled in /etc/ldap.conf. This creates a risk of man-in-the-middle ...

PT-2017-12056

Name of the Vulnerable Software and Affected Versions NixOS versions 17.03 and earlier Description The issue concerns an unintended default absence of SSL Certificate Validation for LDAP in NixOS. Specifically, the users.ldap NixOS module, which implements user authentication against LDAP servers...

CVE-2017-7726: Improper Certificate Validation

iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability...

PT-2017-17910

Name of the Vulnerable Software and Affected Versions iSmartAlarm cube devices affected versions not specified Description The issue is related to an SSL Certificate Validation Vulnerability. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2017-8743

Name of the Vulnerable Software and Affected Versions Acer Portal app versions prior to 3.9.4.2000 Description The issue allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate, due to improper validation of SSL certificates. Recommendations For versions prior ...

Think Mutual Bank Mobile Banking App for iPhone fails to properly validate SSL certificates

Overview Think Mutual Bank mobile banking app for iOS, version 3.1.5 and earlier, fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks. Description CWE-295: Improper Certificate Validation -...

CVE-2016-1519

Affected software: Grandstream Wave app for Android (package com.softphone.common), versions up to and including 1.0.1.26. Vulnerability: Improper SSL certificate validation in the app’s provisioning flow. Impact: Enables MITM attackers to spoof the Grandstream provisioning server via a crafted c...

CVE-2016-1184: Improper Certificate Validation

Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates...

PT-2017-7932

Name of the Vulnerable Software and Affected Versions Tokyo Star bank App for Android versions prior to 1.4 Tokyo Star bank App for iOS versions prior to 1.4 Description The issue concerns the failure to validate SSL certificates. This could potentially allow for man-in-the-middle attacks...

PT-2017-7962

Name of the Vulnerable Software and Affected Versions Grandstream Wave app version 1.0.1.26 and earlier Description The issue concerns the com.softphone.common package in the Grandstream Wave app, which fails to properly validate SSL certificates. This allows man-in-the-middle attackers to spoof...

MODX Revolution Reflective Cross-Site Scripting Vulnerability (CNVD-2017-04879)

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the update and package-installation functions of MODX Revolution...

Design/Logic Flaw

There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398...

CVE-2016-9319

There is Missing SSL Certificate Validation in the Trend Micro Enterprise Mobile Security Android Application before 9.7.1193, aka VRTS-398...

PT-2017-10054

Name of the Vulnerable Software and Affected Versions Trend Micro Enterprise Mobile Security versions prior to 9.7.1193 Description The issue concerns a missing SSL certificate validation in the Android application. Recommendations For versions prior to 9.7.1193, update to version 9.7.1193 or lat...

PT-2017-8819

Name of the Vulnerable Software and Affected Versions IBM Jazz for Service Management affected versions not specified Description The issue is caused by the failure to properly validate the SSL certificate, allowing a remote attacker to obtain sensitive information. An attacker could exploit this...

CVE-2016-5935: Exposure of Sensitive Information to an Unauthorized Actor

IBM Jazz for Service Management could allow a remote attacker to obtain sensitive information, caused by the failure to properly validate the SSL certificate. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Intel CrossWalk project does not validate SSL certificates after first acceptance

Overview The Intel Crosswalk project is a framework for developing hybrid apps for Android and iOS. The Crosswalk project does not properly handle SSL certificate validation when a user accepts an invalid certificate, preventing the app for validating any future SSL certificates. Description...

Design/Logic Flaw

The Huawei Hilink App application before 3.19.2 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008...