CVE-2010-3901

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...

Design/Logic Flaw

Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificat...

Design/Logic Flaw

OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...

CVE-2010-3900

Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312...

CVE-2010-3900

Removed by vendor...

CVE-2010-3312: Undefined Security Weakness

Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificat...

openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)

Updated mysql packages fix the following bugs : - upstream 47320 - checking server certificates CVE-2009-4028 - upstream 48291 - error handling in subqueries CVE-2009-4019 - upstream 47780 - preserving nullvalue flag in GeomFromWKB CVE-2009-4019 - upstream 39277 - symlink behaviour fixed...

MySQL OpenSSL客户端绕过yaSSL服务器证书验证漏洞

BUGTRAQ ID: 37076 CVE ID: CVE-2009-4028 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 在使用OpenSSL的时候，MySQL的viosslfactories.c文件中的vioverifycallback函数可以接受深度为0的X.509证书： vioverifycallback at viosslfactories.c: / Approve cert if depth is greater then "verifydepth", currently verifydepth is always 0 and there...

OpenSSL: DTLS pointer use-after-free flaw (DoS)

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...

USN-792-1: OpenSSL vulnerabilities

It was discovered that OpenSSL did not limit the number of DTLS records it would buffer when they arrived with a future epoch. A remote attacker could cause a denial of service via memory resource consumption by sending a large number of crafted requests. CVE-2009-1377 It was discovered that...

Serena Dimensions CM cryptographic vulnerability

Server certificate is not validated by client...

Design/Logic Flaw

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...

CVE-2009-1379

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...

CVE-2009-1379

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...

CVE-2009-1379

Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...

InGate Firewall和SIParator多个安全漏洞

BUGTRAQ ID: 34309 Ingate Firewall和SIParator都是企业级的硬件防火墙设备。 Ingate Firewall和SIParator中存在多个安全漏洞，恶意用户可以利用这些漏洞执行欺骗攻击、绕过某些安全限制或导致拒绝服务。 1 如果将IPsec隧道将远程网络设置为允许“Remote/private address”配置单元，就可能允许任意用户配置单元。 2 IDS/IPS实现中的错误可能允许SIP报文绕过欺骗和IPsec检查。 3 验证DSA和ECDSA密钥签名中的错误可能导致伪造服务器证书。 4 验证HMAC...

CVE-2008-3532

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

CVE-2008-3532

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

Sony mylo COM-2 does not verify server SSL certificate

Overview Sony mylo COM-2 contains a vulnerability where it does not verify the server certificate when connecting to a server via SSL/TLS. Sony mylo COM-2, a mobile terminal equipped with a web browser and media palyer, contains a vulnerability where it does not verify the server certificate when...

JVN#76788395 Sony mylo COM-2 does not verify server SSL certificate

Sony mylo COM-2, a mobile terminal equipped with a web browser and media palyer, contains a vulnerability where it does not verify the server certificate when connecting to a server via SSL/TLS. Impact Normally, when a client connects to a web server through a SSL/TLS connection, it would verify...