Memory Corruption

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1970,...

Memory Corruption

Mozilla Firefox is an open source web browser. XULRunner provides the XUL Runtime environment for Mozilla Firefox. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. CVE-2012-1970,...

CVE-2019-11324

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...

Lupusec XT2 Plus Main Panel Shared Secrets / Secret Disclosure / CSRF Vulnerabilities

Lupusec XT2 Plus Main Panel with firmware 0.0.2.19E suffers from shared private keys for SSL certificates, root passwords derived from the MAC address, information disclosure, and cross site request forgery vulnerabilities. =======================================================================...

Lupusec XT2 Plus Main Panel Shared Secrets / Secret Disclosure / CSRF

======================================================================= title: Multiple Vulnerabilities product: Lupusec XT2 Plus Main Panel version: Firmware 0.0.2.19E homepage: https://www.lupus-electronics.de/ found: 01/2019 by: D. Fabian...

CVE-2019-6702

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

CVE-2019-6702

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

Design/Logic Flaw

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

CVE-2019-6702

CVE-2019-6702 affects the MasterCard Qkr! iOS app prior to version 5.0.8, with missing SSL certificate validation. The issue enables potential MITM interception on affected versions (noting it applies to obsolete 2016-era releases). Connected sources corroborate a MITM SSL certificate vulnerabili...

CVE-2019-6702

The MasterCard Qkr! app before 5.0.8 for iOS has Missing SSL Certificate Validation. NOTE: this CVE only applies to obsolete versions from 2016 or earlier...

Urban Dictionary: Domain does not Match SSL Certificate

Hi Team, While examining the domains that are in scope for Urban Dictionary, I noticed that https://urbandictionary.net is not currently protected by your SSL certificate. Steps to Reproduce: 1. Open Chrome and copy/paste the following into the search bar: https://www.urbandictionary.net 2. After...

CVE-2019-3841

Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible...

CVE-2019-6592

On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles...

CVE-2019-6592

On BIG-IP 14.1.0-14.1.0.1, TMM may restart and produce a core file when validating SSL certificates in client SSL or server SSL profiles...

CVE-2019-6266

Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext...

Code injection

Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext...

CVE-2019-6266

CVE-2019-6266 affects Cordaware bestinformed for Windows prior to version 6.2.1.0. Public sources describe insecure SSL certificate verification and insecure access patterns, which can allow remote attackers to downgrade encrypted connections to cleartext. Related CNVD entries for the same produc...

CVE-2019-6266

Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext...

JamieWeb: Security headers missed on https://acme-validation.jamieweb.net/

Summary: Hi JamieWeb team, the https://acme-validation.jamieweb.net/ domain doesn't present some important security headers. The X-DNS-Prefetch-Control header isn't specified with value off, so is enabled b default on modern web browsers, and can lead to information disclosure...

Qkr! with MasterPass iOS Application - MITM SSL Certificate Vulnerability

Qkr! with MasterPass is a way to pay for food and drinks on your iOS device. A MITM SSL certificate vulnerability exists in the Qkr! with MasterPass iOS Application. An attacker may provide a fake SSL certificate that the application will silently accept...