3701 matches found
Open Redirect in erudika/scoold
✍️ Description There is an open redirect vulnerability in the following URL: https://live.scoold.com/signin?returnto=https://google.com 🕵️♂️ Proof of Concept Step to reproduce 1. open above URL 2. login in the applicaiton 3. you redirect to google.com 💥 Impact That causes a redirection to an...
Security Bulletin: Vulnerabilities in the Python, Python cryptography , and Urllib3 affect IBM Spectrum Discover.
Summary Vulnerabilities in Python, Python cryptography , and Urllib3 such as buffering problems, SSL certificate validations for HTTP & HTTPS, Bleichenbacher timing attacks in the RSA decryption API, may affect IBM Spectrum Discover. Vulnerability Details CVEID: CVE-2020-36242 DESCRIPTION:...
Updated python-urllib3 package fixes security vulnerabilities
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates for...
MGASA-2021-0377 Updated python-urllib3 package fixes security vulnerabilities
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates for...
PrinterLogic Client Multiple Vulnerabilities (May 3, 2019)
The version of PrinterLogic Client installed on the remote host is affected by the following vulnerabilities: - The PrinterLogic Print Management software does not validate, or incorrectly validates, the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious,...
MGASA-2021-0371 Updated python-pip packages fix security vulnerabilities
A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository CVE-2021-3572. The bundled python-urllib3 was also vulnerable to: The urllib3 library 1.26.x before 1.26.4 for...
Insecure SSL Certificate Validation
github.com/hashicorp/consul has a missing SSL certificate validation. The vulnerability exists due to the xds not ensuring that the subject Alternative Name of an upstream is validated...
Advisory ROSA-SA-2021-1827
Software: elinks 0.12 OS: Cobalt 7.9 CVE-ID: CVE-2012-6709 CVE-Crit: MEDIUM CVE-DESC: ELinks 0.12 and Twibright Links 2.3 lack SSL certificate validation. CVE-STATUS: Default CVE-REV: Default...
Security Bulletin: IBM Cloud Transformation Advisor is affected by Node.js vulnerability
Summary IBM Cloud Transformation Advisor has addressed Node.js vulnerability CVE-2021-31597 Vulnerability Details CVEID: CVE-2021-31597 DESCRIPTION: Node.js xmlhttprequest-ssl module is vulnerable to a man-in-the-middle attack, caused by the disalbe of SSL certificate validation by default. An...
Medium: python-pip
Issue Overview: A flaw was found in python-urllib3. SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy if an SSLContext isn't given via proxyconfig doesn't verify the hostname of the certificate. This means certificates...
CVE-2021-22895
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow...
CVE-2021-22895
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow...
CVE-2021-22895
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow...
CVE-2021-22895
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow...
CVE-2021-22895
Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow...
SUSE: Security Advisory (SUSE-SU-2014:1006-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SSL certificate was not validated in Provider Registration Flow
None...
Design/Logic Flaw
A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise...
Authorization for organizations with modern app-only authentication fails due to expired SSL certificate
Challenge An attempt to authenticate a tenant connection using Veeam Backup for Microsoft 365 REST API fails with an invalid/expired certificate error. Cause The SSL certificate for the login.microsoftonline.com site has expired in the local certificate store. Solution To update an expired...
Improper Verification of Cryptographic Signature
Overview The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized when the property exists but is undefined is considered to be false within the https.request function of Node.js. In other words, no certificate is ever...