PYSEC-2014-72

Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073...

CVE-2014-0837

The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate...

Fedora 19 : ssmtp-2.64-9.fc19 (2013-15049)

Use a corrected patch to validate server certificates Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Note that Tenable Network...

Fedora 18 : ssmtp-2.64-9.fc18 (2013-15036)

Use a corrected patch to validate server certificates Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Removes world read access from the configuration file thus prohibiting reading of password stored inside it. Note that Tenable Network...

CVE-2012-6606

Palo Alto Networks GlobalProtect before 1.1.7, and NetConnect, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof portal servers and obtain sensitive information via a crafted certificate...

JVN#68156832: Yafuoku! contains an issue where it fails to verify SSL server certificates

Yafuoku! provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the informati...

Design/Logic Flaw

The Pizza Hut Japan Official Order application before 1.1.1.a for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2012-3094

The VPN downloader in the downloadinstall component in Cisco AnyConnect Secure Mobility Client 3.1.x before 3.1.00495 on Linux accepts arbitrary X.509 server certificates without user interaction, which allows remote attackers to obtain sensitive information via vectors involving an invalid...

Opera fails to verify SSL server certificates

Overview Opera contains an issue where it fails to verify SSL server certificates. Opera is a web browser. Opera contains an issue where it fails to verify SSL server certificates. Impact The user may unknowingly connect to a site that is using a certificate not authorized by a CA. As a result, t...

CVE-2012-0732

The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

Software Center in Ubuntu 11.10, 11.04 10.10 does not properly validate server certificates, which allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2011-3150

Software Center in Ubuntu 11.10, 11.04 10.10 does not properly validate server certificates, which allows remote attackers to execute arbitrary code or obtain sensitive information via a man-in-the-middle MITM attack...

Software Center certificate spoofing

insufficient check for server certificates...

Ubuntu 10.10 / 11.04 / 11.10 : software-center vulnerability (USN-1270-1)

David B. discovered that Software Center incorrectly validated server certificates when performing secure connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information or install altered packages and repositories. Not...

THE CRAZIES Hackers Leaks Server Certificates of Defense Information Systems Agency (DISA)

THE CRAZIES Hackers Leaks Server Certificates of Defense Information Systems Agency DISA THE CRAZIES Hackers steal the Several Certificate revocation lists CRLs from Server of Defense Information Systems Agency DISA - https://disa.mil/ and leak the Certificates at :...

CVE-2010-3900

Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312...

SuSE 10 Security Update : MySQL (ZYPP Patch Number 6899)

This update fixes various security issues bnc557669 : upstream 47320 - checking server certificates CVE-2009-4028 upstream 48291 - error handling in subqueries CVE-2009-4019 upstream 47780 - preserving nullvalue flag in GeomFromWKB CVE-2009-4019 upstream 39277 - symlink behaviour fixed...

openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-1)

This update fixes several security issues in mysql : - checking server certificates CVE-2009-4028 - error handling in subqueries CVE-2009-4019 - preserving nullvalue flag in GeomFromWKB CVE-2009-4019 - symlink behavior fixed CVE-2008-7247 - symlink behavior refixed CVE-2009-4030 %NASLMINLEVEL 703...

CVE-2008-3532

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

JVN#88676089 Safari installed in iPod touch and iPhone vulnerable in handling server certificates

Safari is a web browser provided by Apple. Safari installed in iPod touch and iPhone accepts a self-signed or invalid server cerficate without the user's explicit concent when connecting via SSL/TLS. According to Apple, "When Safari accesses a website that uses a self-signed or invalid certificat...