PT-2024-29331 · Goframe · Goframe

Name of the Vulnerable Software and Affected Versions: goframe version 2.7.2 Description: The issue allows attackers to execute a man-in-the-middle attack due to the software being configured to skip TLS certificate verification via the gclient component. Recommendations: For goframe version 2.7....

CVE-2024-41256

CVE-2024-41256 concerns filestash v0.4, where default configurations in the ShareProofVerifier can skip TLS certificate verification when sending email verification codes. This creates a potential for a man-in-the-middle to access sensitive data through tampered or intercepted email communication...

CVE-2024-41256

Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-the-middle attack...

CVE-2024-6197

A vulnerability was found in cURL's utf8asn1str function in the ASN1 parser, which causes a denial of service due to a memory allocation flaw. This flaw allows a remote attacker to use a specially crafted TLS certificate, causing the function to invoke free on a 4-byte local stack buffer. While...

MGASA-2024-0268 Updated libreoffice packages fix security vulnerability

TLS certificates are not properly verified when utilizing LibreOfficeKit. CVE-2024-5261...

CVE-2024-28872

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-28872

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-28872

The CVE-2024-28872 issue affects ISC Stork versions 0.15.0 through 1.15.0 and stems from flawed TLS certificate validation. An attacker could obtain a TLS certificate from the Stork server and use it to connect to the Stork agent, then issue malicious commands to monitored services (Kea or BIND 9...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

CVE-2024-28872 Incorrect TLS certificate validation can lead to escalated privileges

The TLS certificate validation code is flawed. An attacker can obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once this connection is established with the valid certificate, the attacker can send malicious commands to a monitored service Kea or BIND 9,...

Internet Systems Consortium Stork Security Breach

Internet Systems Consortium Stork ISC Stork is an open source graphical administration from the Internet Systems Consortium organization. It is used to monitor, troubleshoot and maintain the configuration of Kea DHCP servers. A security vulnerability exists in Internet Systems Consortium Stork...

USN-6877-1: LibreOffice vulnerability

It was discovered that LibreOffice incorrectly performed TLS certificate verification when the LibreOfficeKit library is being used by third-party components. A remote attacker could possibly use this issue to obtain sensitive information...

[SECURITY] Fedora 40 Update: firmitas-0.1.3-1.fc40

Simple notification service for X.509-standard TLS certificate statuses...

Ubuntu 23.10 / 24.04 LTS : LibreOffice vulnerability (USN-6877-1)

The remote Ubuntu 23.10 / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6877-1 advisory. It was discovered that LibreOffice incorrectly performed TLS certificate verification when the LibreOfficeKit library is being used by third-party...

LibreOffice Improper Certificate Validation Vulnerability (Jul 2024) - Mac OS X

LibreOffice is prone to an improper certificate validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

LibreOffice Improper Certificate Validation Vulnerability (Jul 2024) - Windows

LibreOffice is prone to an improper certificate validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GO-2024-2532 Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary

Boundary vulnerable to session hijacking through TLS certificate tampering in github.com/hashicorp/boundary...

CVE-2024-5261 TLS certificate are not properly verified when utilizing LibreOfficeKit

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to conver...

CVE-2024-5261 TLS certificate are not properly verified when utilizing LibreOfficeKit

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to conver...

PT-2024-6389 · Libnbd +7 · Libnbd +7

Name of the Vulnerable Software and Affected Versions: libnbd affected versions not specified Description: The issue is related to a flaw in the libnbd library, where the client does not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This allows a...