CVE-2020-14981

The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation...

ssl.sagafoto.at Cross Site Scripting vulnerability OBB-1203336

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

The vulnerability of the SSL_check_chain function in the TLS protocol implementation of the OpenSSL library involves the possibility of reassigning the null pointer due to incorrect processing of the “signature_algorithms_cert” extension in TLS. This allows a perpetrator to cause a service failure.

The vulnerability of the SSLcheckchain function in the TLS protocol implementation of the OpenSSL library is related to the possibility of replacing the zero pointer due to incorrect processing of the “signaturealgorithmscert” extension in TLS. Exploiting this vulnerability can allow a malicious...

The vulnerability of the Montgomery quadradic multiplication algorithm implementation in OpenSSL libraries is related to an error in integer transfer on the x86_64 platform, which allows an attacker to gain unauthorized access to sensitive information.

The vulnerability of the Montgomery quadradic multiplication algorithm implementation in the OpenSSL library is related to an error in arithmetic operations on the x8664 platform. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain unauthorized access to sensiti...

ssl.selesite.com Cross Site Scripting vulnerability OBB-1202486

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Nextcloud: SSL certificate not validated when registering with a provider

Description When running the desktop client for the first time, users can click the "Register with a provider" button to sign up for a Nextcloud account with a Nextcloud cloud provider. Clicking "Register..." opens a web page in a Nextcloud desktop client window with content from...

PT-2020-6431 · Nextcloud +1 · Nextcloud Desktop Client +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Desktop Client versions prior to 3.3.1 Description: The issue is related to the lack of SSL certificate verification when using the "Register with a Provider" flow in the Nextcloud Desktop Client, allowing a remote attacker to impac...

CVE-2016-11076

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

CVE-2016-11076

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

Design/Logic Flaw

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

CVE-2016-11076

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL...

CVE-2016-11076

Summary: Mattermost Server prior to 3.0.0 does not ensure cookies are transmitted over SSL. This is the root cause described consistently across CVE-2016-11076 references (NVD, Red Hat, SUSE, osv.dev). The connected documents confirm the same issue; no public exploit details or remediation steps ...

The vulnerability of the program for installing SSL certificates in the standardized Linux Sblim-sfcb toolset is related to an incorrect definition of the link before accessing the file. This allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability in the program for installing SSL certificates in the standardized Linux Sblim-sfcb tool relates to an incorrect definition of the link before accessing the file. Exploiting this vulnerability can allow a perpetrator to gain access to confidential data, compromise its integrity,...

Man-in-the-middle (MitM)

em-http-request is vulnerable to man-in-the-middle MitM. It uses the library eventmachine insecurely as it misses SSL/TLS certificate hostname verification, allowing a man-in-the-middle attack against the users of the library...

Denial Of Service (DoS)

libvncserver.so is vulnerable to denial of service DoS. The vulnerability exists through a NULL pointer dereference in libvncclient/tlsopenssl.c when opening a SSL connection...

GaussDB: Restricting the Permission for the SSL Private Key

If SSL is used, you need to configure the SSL certificate on the database server. You are advised to set the permission for the private key file to owner-readable-only. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright...

LibVNCServer code issue vulnerability (CNVD-2020-36782)

LibVNCServer is a cross-platform C library that supports the implementation of VNC Virtual Network Computing server or client functionality in a program. A code issue vulnerability exists in the libvncclient/tlsopenssl.c file in versions of LibVNCServer prior to 0.9.13. A remote attacker could...

What’s in the Box? Part II: Hacking the iParcelBox

ARCHIVED STORY What’s in the Box? Part II: Hacking the iParcelBox By Steve Povolny · June 18, 2020 Package delivery is just one of those things we take for granted these days. This is especially true in the age of Coronavirus, where e-commerce and at-home deliveries make up a growing portion of...

EulerOS 2.0 SP2 : php (EulerOS-SA-2020-1632)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, whi...

CVE-2019-17655

A cleartext storage in a file or on disk CWE-313 vulnerability in FortiOS SSL VPN 6.2.0 through 6.2.2, 6.0.9 and earlier and FortiProxy 2.0.0, 1.2.9 and earlier may allow an attacker to retrieve a logged-in SSL VPN user's credentials should that attacker be able to read the session file stored on...