1160 matches found
PT-2021-22568 · Gnome +8 · Gnome Grilo +8
Name of the Vulnerable Software and Affected Versions: GNOME grilo versions prior to 0.3.14 Description: The issue is related to the lack of TLS certificate verification in the SoupSessionAsync objects created by grl-net-wc.c, making users susceptible to network man-in-the-middle MITM attacks...
CVE-2021-39359
CVE-2021-39359 affects GNOME libgda up to 6.0.0, where gda-web-provider.c creates SoupSessionSync objects without TLS certificate verification, leaving users exposed to network MITM attacks. This aligns with the general pattern of CVE-2016-20011. The connected Nessus/NASL entries corroborate the ...
CVE-2021-39359
In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011...
CVE-2021-37698
CVE-2021-37698 affects Icinga 2 (versions 2.5.0–2.13.0) where ElasticsearchWriter, GelfWriter, InfluxdbWriter and Influxdb2Writer fail to verify the server’s certificate even when a CA is configured. This TLS validation flaw can enable credential exposure or impersonation when connecting to TSDBs...
Affirm: Subdomain takeover of www█████████.affirm.com
Summary Hi there, assuming you want this report as your policy mentions Affirm resources with third-parties, but the scope was a little unclear. Regardless, www█████.affirm.com points to an AWS S3 bucket affirm-prod-www-cms█████████ that no longer exists. I was able to take control of this bucket...
Huawei EulerOS: Security Advisory for glib-networking (EulerOS-SA-2021-2244)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Huawei EulerOS: Security Advisory for glib-networking (EulerOS-SA-2021-2270)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
EulerOS 2.0 SP9 : glib-networking (EulerOS-SA-2021-2244)
According to the version of the glib-networking package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS...
openSUSE 15 Security Update : balsa (openSUSE-SU-2021:1094-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2021:1094-1 advisory. - In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if...
In words.protocols.jabber.xmlstream in Twisted through 19.2.1 XMPP support did not verify certificates when used with TLS allowing an attacker to MITM connections.
...
CVE-2020-12681
Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied...
CVE-2020-12681
Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied...
Design/Logic Flaw
Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied...
CVE-2020-12681
The CVE-2020-12681 issue affects 3xLogic Infinias eIDC32 devices (through version 3.4.125). Root cause: missing TLS certificate validation, enabling an attacker to intercept or control the channel used to apply door lock policies. Impact, as stated, is the interception/control of policy applicati...
CVE-2020-12681
Missing TLS certificate validation on 3xLogic Infinias eIDC32 devices through 3.4.125 allows an attacker to intercept/control the channel by which door lock policies are applied...
Insecure Validation
Fossil has insecure validation. The vulnerability exists due to the system skipping the hostname check during TLS certificate validation...
Updated libgrss packages fix security vulnerability
libgrss does not perform any TLS certificate verification because it uses the deprecated SoupSessionAsync, which requires manually enabling certificate verification, rather than a modern SoupSession that has good defaults CVE-2016-20011...
MGASA-2021-0343 Updated libgrss packages fix security vulnerability
libgrss does not perform any TLS certificate verification because it uses the deprecated SoupSessionAsync, which requires manually enabling certificate verification, rather than a modern SoupSession that has good defaults CVE-2016-20011...