CVE-2025-64649

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

CVE-2025-64649

IBM Concert versions 1.0.0 through 2.3.1 are affected by improper certificate validation , allowing a remote attacker to perform unauthorized actions via man-in-the-middle techniques. The vulnerability carries a CVSS 3.1 score of 5.9 (MEDIUM) with a high attack complexity, no privileges required,...

CVE-2025-64649 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 2.3.1 could allow a remote attacker to perform unauthorized actions using man in the middle techniques due to improper certificate validation...

CVE-2025-36290 IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

IBM Integrated Analytics System 1.0.0.0 through 1.0.31.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques...

CVE-2025-36290

IBM Integrated Analytics System (IIAS) versions 1.0.0.0 through 1.0.31.0 contain a vulnerability in the JWT service component (apjwtservice.py module), where SSL/TLS server certificate validation is not enabled on an SSL/TLS connection. This allows a remote attacker to perform man-in-the-middle a...

CVE-2026-55215

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

Summary When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the...

GHSA-CQHC-2H57-WPXF MariaDB's connector leaks the cleartext password to an MitM despite `ssl: true`

Summary When SSL/TLS is enabled but no CA / server certificate is provided, the connector verifies the server's identity using fingerprint validation. The check is effective, the connection is ultimately rejected when it fails, but it happens after the authentication exchange. As a result, the...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-55215 MariaDB Connector/Node.js: Connector leaks the cleartext password to an MitM despite `ssl: true`

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to versions 3.3.3, 3.4.6, and 3.5.3, when ssl is enabled without a pinned CA or server certificate, MariaDB Connector/Node.js sends credentials before completing certificate...

CVE-2026-80652

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the...

EUVD-2026-67309

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

CVE-2026-18717

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

Security Bulletin: Security Vulnerability in Apache Zookeeper affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-24281 CVE-2026-24308)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to Apache Zookeeper Vulnerability Details CVEID:CVE-2026-24281 DESCRIPTION: Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS PTR when IP SAN validation fails,...

PT-2026-83321

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.3.1 Description Improper certificate validation allows a remote attacker to perform unauthorized actions using man-in-the-middle techniques. Man-in-the-middle is a type of attack where an actor secretly...

PT-2026-83320

Name of the Vulnerable Software and Affected Versions IBM Integrated Analytics System versions 1.0.0.0 through 1.0.31.0 Description The system fails to properly validate TLS certificates. This flaw allows an attacker to perform man-in-the-middle techniques to intercept and obtain sensitive...

PT-2026-83237

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions 3.3.0 through 3.3.2 MariaDB Connector/Node.js versions 3.4.0 through 3.4.5 MariaDB Connector/Node.js versions 3.5.0 through 3.5.2 Description When SSL is...

CVE-2026-18717 Improper Certificate Validation in ASE 2000

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications...

CVE-2026-18717

ASE2000 versions 2.35 through 2.37 (by ASE Systems) contain an improper certificate validation vulnerability in the TLS implementation. An attacker with network access may impersonate a trusted peer, complete the TLS handshake, and read or modify protected communications. The CISA ICS advisory ra...

Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization

Summary IBM Financial Transaction Manager for RedHat OpenShift has addressed the following vulnerabilities. Vulnerability Details CVEID:CVE-2025-68121 DESCRIPTION: During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial...