CVE-2016-3677

Huawei Wear App for Android is affected (versions before 15.0.0.307) by CVE-2016-3677 due to lack of SSL certificate validation. This allows local users to cause unspecified impact via unknown vectors. Remediation per Huawei advisory is to update to a fixed version (15.0.0.307 or later); exploita...

CVE-2016-4005: Undefined Security Weakness

The Huawei Hilink App application before 3.19.2 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008...

CVE-2016-3677: Insufficient Verification of Data Authenticity

The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008...

PT-2016-5652

Name of the Vulnerable Software and Affected Versions Huawei Wear App version prior to 15.0.0.307 Description The issue concerns the Huawei Wear App's failure to validate SSL certificates, allowing local users to have an unspecified impact. Recommendations For versions prior to 15.0.0.307, update...

PT-2016-5804

Name of the Vulnerable Software and Affected Versions Huawei Hilink App version prior to 3.19.2 Description The issue concerns the Huawei Hilink App's failure to validate SSL certificates, allowing local users to have an unspecified impact. Recommendations For versions prior to 3.19.2, update to...

Jetstar Airways Jetstar App for iOS Man-in-the-Middle Attack Vulnerability

Jetstar Airways Jetstar App for iOS is a suite of iOS-based applications from Jetstar Airways Australia that provide air ticket search, booking and other functions. A man-in-the-middle attack vulnerability exists in Jetstar Airways Jetstar App for iOS versions prior to 3.0.0, which originates fro...

MariaDB Server 5.5.x < 5.5.47 / 10.0.x < 10.0.23 / 10.1.x < 10.1.10 Multiple Vulnerabilities

Binary data 9287.prm...

SUSE-SU-2016:1195-1 Security update for python-tornado

The python-tornado module was updated to version 4.2.1, which brings several fixes, enhancements and new features. The following security issues have been fixed: - A path traversal vulnerability in StaticFileHandler, in which files whose names started with the staticpath directory but were not...

Security Advisory - Vulnerability of No SSL Certificate Validation in Huawei Wear App and Hilink APP

A vulnerability of no SSL certificate validation exists in Huawei Wear APP and Hilink APP. These APPs still load the web page when accessing a website whose SSL certificate has issues, which brings risks to users. Vulnerability ID: HWPSIRT-2016-03008 This vulnerability has been assigned a Common...

ANA App SSL Certificate Validation Security Bypass Vulnerability

ANA App is a suite of ANA airline inquiry applications. ANA App fails to properly validate SSL certificates, allowing remote attackers to exploit this vulnerability to conduct man-in-the-middle attacks and spoof trusted servers...

async-http-client certificate validation vulnerability

async-http-client is a client library that allows Java applications to perform HTTP requests and asynchronously process that HTTP response. async-http-client fails to properly disable SSL/TLS certificate validation, allowing an attacker to exploit the vulnerability to conduct a man-in-the-middle...

CVE-2014-9326

CVE-2014-9326 affects F5 BIG-IP products where the automatic update check (Phone Home) and ASM Call Home auto-signature update do not properly validate SSL server certificates, enabling MITM via crafted certificates. Affected: BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, Link Controller (versions 1...

CVE-2014-9326: Undefined Security Weakness

The automatic signature update functionality in the 1 Phone Home feature in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, GTM, and Link Controller 11.5.0 through 11.6.0, ASM 10.0.0 through 11.6.0, and PEM 11.3.0 through 11.6.0 and the 2 Call Home feature in ASM 10.0.0 through 11.6.0 and PEM 11.3.0...

Second Crypto Bug in Networking Library Could Affect 25,000 Apps

A few weeks after the developers of the AFNetworking library that’s popular among iOS and OS X app developers patched a serious bug in the library that enabled man-in-the-middle attacks, another, similar flaw has surfaced. The new vulnerability is related to how the AFNetworking library handles...

Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable to Hackers

A critical vulnerability resides in AFNetworking could allow an attacker to cripple the HTTPS protection of 25,000 iOS apps available in Apple's App Store via man-in-the-middle MITM attacks. AFNetworking is a popular open-source code library that lets developers drop networking capabilities into...

MGASA-2015-0165 Updated lftp packages fix CVE-2014-0139

Updated lftp packages fix security vulnerability: lftp incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or ju...

Renewed Attention on Android Apps Failing SSL Validation

SAN FRANCISCO – Android developers whose apps fail to validate SSL certificates are on notice; not only are researchers scanning apps making insecure connections, but so is Google. And the hammer may fall soon. Will Dormann, a researcher with CERT at the Software Engineering Institute at Carnegie...

iOS, OS X Library AFNetwork Patches MiTM Vulnerability

Until yesterday, a popular networking library for iOS and OS X used in apps such as Pinterest and Simple was susceptible to SSL man-in-the-middle MiTM attacks. The developer behind the framework AFNetworking on Thursday pushed a fix for the issue, a logic flaw. The flaw had lingered in the wild f...

CVE-2014-3691

Smart Proxy aka Smart-Proxy and foreman-proxy in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate...

Komodia Certificate Manipulation Enabled Man-In-The-Middle Attacks

The shoddy state of SSL certificate validation on the Internet again floated to the surface, this time by the Superfish mess, which continues to get worse. The Electronic Frontier Foundation on Wednesday released a report based on data scoured from the Decentralized SSL Observatory which it...