gnutls: fixed SSL certificate validation (critical)

The gnutls library was updated to fix SSL certificate validation. Remote man-in-the-middle attackers were able to make the verification believe that a SSL certificate is valid even though it was not...

gnutls: fixed SSL certificate validation problems (critical)

The gnutls library was updated to fixed x509 certificate validation problems, where man-in-the-middle attackers could hijack SSL connections. This update also reenables Elliptic Curve support to meet current day cryptographic requirements...

Apple Updates iOS Security Guide

Apple rarely offers anyone a glimpse inside its walled-off security garden. The last time it did was in the spring of 2012 when it released a detailed paper on the security of its iOS operating system for iPhones and iPads. The company also presented a much-anticipated if not anticlimactic...

Denny's App for Android SSL证书校验安全绕过漏洞

Bugtraq ID:65810 CVE ID:CVE-2014-1967 Denny's App for Android是一款基于安卓的应用程序。 Denny's App for Android没有正确校验SSL服务器证书，允许远程攻击者利用漏洞提交恶意证书伪造服务器，获取敏感信息等。 0 Denny's App for Android ver.2.0.0 厂商补丁： Denny's App ----- Denny's App for Android. ver.2.0.1已经修复该漏洞，建议用户下载更新：...

Internet Bug Bounty: Widespread failure of certificate validation in Android apps

I have identified approximately 75 Android applications and some iPad that fail to validate SSL certificates, either failing to validate valid certificate authorities, correct hostnames or both. I have made attempts to responsibly disclose all of these vulns to the responsible parties. A few have...

Exploit for Improper Certificate Validation in Apple Iphone_Os

OS X/iOS SSL Flaw POC Overview This repository contains s...

Why You need to Stop using WhatsApp?

If you haven’t heard by now, Facebook just made its biggest move ever, buying the messaging service WhatsApp in a deal worth some $19 billion. That’s 19 times what Facebook paid for Instagram two years ago. The WhatsApp Service run by the team of just 32 engineers, handles more than 50 Billion...

Core FTP 'AUTH SSL' 命令拒绝服务漏洞

BUGTRAQ ID: 65432 CVECAN ID: CVE-2014-1441 CoreFTP是免费的FTP客户端。 Core FTP 1.2 build 511及其他版本处理AUTH SSL命令时存在错误，这可使攻击者通过特制的SSL证书，造成服务器崩溃。 0 Core FTP Core FTP 1.x 厂商补丁： Core FTP -------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.coreftp.com/...

CVE-2014-1910

Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers, which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2013-6396

The OpenStack Python client library for Swift python-swiftclient 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2013-6396

The OpenStack Python client library for Swift python-swiftclient 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Hackers targeting non-browser applications with Fake SSL Certificates

Having SSL Certification doesn't mean that the website you are visiting is not a bogus website. SSL certificates protect web users in two ways, it encrypts sensitive information such as usernames, passwords, or credit card numbers and also verify the identity of websites. But today hackers and...

wget security update

CentOS Errata and Security Advisory CESA-2014:0151 An updated wget package that fixes one security issue and one bug is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS...

RedHat Update for wget RHSA-2014:0151-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2011-4092

obby aka libobby does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate...

DEBIAN-CVE-2012-5524

The sslverifycallback function in tlsnb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle MITM attacks and spoof servers via an arbitrary certificate from a trusted CA...

CVE-2012-5524

The sslverifycallback function in tlsnb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle MITM attacks and spoof servers via an arbitrary certificate from a trusted CA...

Cisco TelePresence Video Communication Server Expressway Default SSL Certificate

The X.509 certificate of the remote host is known to ship by default with the remote service / device. The private key for this cert has been published, therefore the SSL communications done with the remote host cannot be considered secret as anyone with the ability to snoop the traffic between t...

Malicious Russian Tor Exit Relays Intercepting encrypted Traffic of Facebook Users

Tor is one of the best and freely available privacy software that lets people communicate anonymously online through a series of nodes that is designed to provide anonymity for users and bypass Internet censorship. When you use the Tor software, your IP address remains hidden and it appears that...

MGASA-2014-0014 Updated elinks package fixes a security vulnerability

Updated elinks package fixes security vulnerability: When verifying SSL certificates, elinks fails to warn the user if the hostname of the certificate does not match the hostname of the website. The elinks package has been updated to version 0.12-pre6 and patched to fix this issue...