IBM QRadar Suite 安全漏洞

IBM QRadar Suite is an integrated security information and event management SIEM solution from International Business Machines IBM that monitors and analyzes network activity in an organization to detect potential security threats. A certificate validation error vulnerability exists in IBM QRadar...

Security Bulletin: IBM QRadar Suite software is vulnerable to information exposure and man in the middle attacks (CVE-2023-47742, CVE-2024-22355)

Summary IBM QRadar Suite software is vulnerable to information exposure through password practices & man in the middle attacks, due to certificate validation issues. This has been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the...

Fortinet FortiOS Trust Management Issues Vulnerability (CNVD-2024-13096)

Fortinet FortiOS is a set of U.S. Fita Fortinet dedicated to FortiGate network security platform on the security operating system. A trust management issue vulnerability exists in Fortinet FortiOS that stems from the presence of incorrect certificate validation, which can be exploited by an...

PT-2024-2057 · Ibm · Ibm Qradar Suite Products +1

Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite Products versions 1.10.12.0 through 1.10.18.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue is related to the incorrect enforcement of certificate validation, which could allow an...

MongoDB Server may allow successful untrusted connection

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which may result in untrusted connections to succeed. This may effectively reduce the security guarantees provided by TLS and open connections that should have been closed due to failin...

CentOS 9 : qt5-qtbase-5.15.9-6.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the qt5-qtbase-5.15.9-6.el9 build changelog. - An issue was discovered in Qt before 5.15.15, 6.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.2. Certificate validation for TLS does not...

CentOS 9 : curl-7.76.1-26.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the curl-7.76.1-26.el9 build changelog. - A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on...

MikroTik RouterOS Improper Certificate Validation (CVE-2018-10066)

An issue was discovered in MikroTik RouterOS 6.41.4. Missing OpenVPN server certificate verification allows a remote unauthenticated attacker capable of intercepting client traffic to act as a malicious OpenVPN server. This may allow the attacker to gain access to the client's internal network fo...

The vulnerability of the Zscaler Internet Access (ZIA) domain detection module allows a hacker to execute a “man-in-the-middle” attack.

The vulnerability of the Zscaler Internet Access ZIA domain detection module is related to errors in the certificate validation process. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attack...

PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability. The specific flaw exists within the update functionality. The issue results from the lack of proper...

Improper Certificate Validation

org.apache.dolphinscheduler: dolphinscheduler-common is vulnerable to Improper Certificate Validation. The vulnerability is due to a lack of certificate verification in the HttpUtils class. This allows an attacker to perform a Man-in-the-Middle MITM attack by impersonating the server...

Missing Certificate Validation

apacheairflowprovidersmongo is vulnerable to Missing Certificate Validation. The vulnerability is due to the default inclusion of the allowinsecure option when SSL was enabled. This flaw resulted in certificates not being properly validated...

GHSA-X5PM-H33Q-CJRW Improper Certificate Validation in apache airflow mongo hook

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

Improper Certificate Validation in apache airflow mongo hook

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

Design/Logic Flaw

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2024-25141 Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2024-25141 Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

CVE-2024-25141

The CVE-2024-25141 issue concerns Apache Airflow Mongo Hook/Provider components where, when SSL is enabled, the default setting allow_insecure caused certificates not to be validated. This undermines TLS trust and can enable man-in-the-middle scenarios. Affected components are described across mu...

CVE-2024-25141 Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

Improper Certificate Validation in Apache DolphinScheduler

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.1. Users are recommended to upgrade to version 3.2.1, which...