3701 matches found
GHSA-QX72-Q6W3-QGC7 SaltStack Salt Improper SSL Certificate Validation
In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated...
GHSA-W6XV-MF6F-R5F6 Scalyr Agent Missing SSL Certificate Validation
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verifyhostname option...
GHSA-738X-V49G-P6HX Scalyr Agent 2 Missing SSL Certificate Validation
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName...
Scalyr Agent 2 Missing SSL Certificate Validation
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName...
GHSA-QGP8-H5CP-R75R Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation
Jenkins Bumblebee HP ALM Plugin unconditionally disabled SSL/TLS certificate validation for connections to the HP ALM service. Bumblebee HP ALM Plugin no longer does that. Instead, it now allows users to opt out of certificate validation...
Oracle Linux 8 : postgresql:10 (ELSA-2022-1830)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-1830 advisory. 10.19-2 - Add missing files into file section of server package postgresql-setup v8.6 newly provides postgresql-upgrade Tenable has extracted the preceding...
GHSA-5MGJ-MVV8-46MW RubyGems does not verify SSL certificate
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack...
RubyGems does not verify SSL certificate
RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack...
Tweepy does not verify SSL Certificate
Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library...
HCL Technologies HCL Verse Information Disclosure Vulnerability
HCL Technologies HCL Verse is a mobile application from HCL Technologies India that allows access to emails and life plan management.A security vulnerability exists in versions of HCL Technologies HCL Verse for Android prior to version 12.0.9, which stems from a server setup and login process in...
httplib2 incorrectly checks SSL certificate
httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary...
GHSA-Q48Q-77QV-CF9P httplib2 incorrectly checks SSL certificate
httplib2 prior to version 0.10.1, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary...
CVE-2021-27768 An SSL certificate host verification vulnerability affects HCL Verse for Android
Using the ability to perform a Man-in-the-Middle MITM attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode...
U.S. Dept Of Defense: CVE-2020-3187 - Unauthenticated Arbitrary File Deletion
A vulnerability in the web services interface of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to sensitive files on a targeted...
U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA
i found out that https://█████████/ was vulnerable to CVE-2020-3452 The IP has a SSL certificate pointing to █████████ curl -kv https://██████████/ Output Server certificate: subject: C=US; ████.mil Impact Anyone can read any file present on the server. System Hosts ███ Affected Products and...
U.S. Dept Of Defense: [CVE-2020-3452] Unauthenticated file read in Cisco ASA
i found out that https://█████/ was vulnerable to CVE-2020-3452 The IP has a SSL certificate pointing to ██████████ curl -kv https://███████/ Output; Server certificate: ███ Impact Anyone can read any file present on the server. System Hosts █████ Affected Products and Versions CVE Numbers...
SSL Certificate with no Subject
The remote system is providing an SSL/TLS certificate without a subject field. While this is not required in all cases, it is recommended to ensure broad compatibility. TRUSTED...
[ASA-202204-1] postgresql: man-in-the-middle
Arch Linux Security Advisory ASA-202204-1 ========================================= Severity: High Date : 2022-04-04 CVE-ID : CVE-2021-23214 Package : postgresql Type : man-in-the-middle Remote : Yes Link : https://security.archlinux.org/AVG-2546 Summary ======= The package postgresql before...
Jenkins Proxmox Plugin 信任管理问题漏洞
Jenkins and Jenkins Plugin are both Jenkins open source products. jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Proxmox Plugin 0.6.0 and earlier...
