PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...

CVE-2016-11076

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

CVE-2016-11076

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

CVE-2016-11076

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

CVE-2016-11076

Summary: Mattermost Server prior to 3.0.0 does not ensure cookies are transmitted over SSL. This is the root cause described consistently across CVE-2016-11076 references (NVD, Red Hat, SUSE, osv.dev). The connected documents confirm the same issue; no public exploit details or remediation steps ...

The vulnerability of the program for installing SSL certificates in the standardized Linux Sblim-sfcb toolset is related to an incorrect definition of the link before accessing the file. This allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability in the program for installing SSL certificates in the standardized Linux Sblim-sfcb tool relates to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow a perpetrator to gain access to confidential data, compromise its integrity,...

Man-in-the-middle (MitM)

em-http-request is vulnerable to man-in-the-middle MitM. It uses the library eventmachine insecurely as it misses SSL/TLS certificate hostname verification, allowing a man-in-the-middle attack against the users of the library...

Denial Of Service (DoS)

libvncserver.so is vulnerable to denial of service DoS. The vulnerability exists through a NULL pointer dereference in libvncclient/tlsopenssl.c when opening a SSL connection...

GaussDB: Restricting the Permission for the SSL Private Key

If SSL is used, you need to configure the SSL certificate on the database server. You are advised to set the permission for the private key file to owner-readable-only. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright...

LibVNCServer code issue vulnerability (CNVD-2020-36782)

LibVNCServer is a cross-platform C library that supports the implementation of VNC Virtual Network Computing server or client functionality in a program. A code issue vulnerability exists in the libvncclient/tlsopenssl.c file in versions of LibVNCServer prior to 0.9.13. A remote attacker could...

What’s in the Box? Part II: Hacking the iParcelBox

ARCHIVED STORY What’s in the Box? Part II: Hacking the iParcelBox By Steve Povolny · June 18, 2020 Package delivery is just one of those things we take for granted these days. This is especially true in the age of Coronavirus, where e-commerce and at-home deliveries make up a growing portion of...

EulerOS 2.0 SP2 : php (EulerOS-SA-2020-1632)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, whi...

CVE-2019-17655

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...

CVE-2019-17655

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...

Session fixation

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...

CVE-2019-17655

CVE-2019-17655 affects Fortinet FortiOS SSL VPN (versions 6.2.0–6.2.2 and 6.0.9 and earlier) and FortiProxy (2.0.0, 1.2.9 and earlier). The issue is a cleartext storage flaw (CWE-313) that may allow an attacker who can read the session file on disk to retrieve a logged‑in SSL VPN user’s credentia...

CVE-2019-17655

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...

CVE-2019-17655

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...

CVE-2020-4320

IBM MQ Appliance and IBM MQ AMQP Channels 8.0, 9.0 LTS, 9.1 LTS, and 9.1 CD do not correctly block or allow clients based on the certificate distinguished name SSLPEER setting. IBM X-Force ID: 177403...