GHSA-GH2C-6M38-C78J PyWBEM TOCTOU vulnerability in certificate validation

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PyWBEM TOCTOU vulnerability in certificate validation

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java OpenSAML-J before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a...

GHSA-V4W5-P2HG-8FH6 Urllib3 Incorrect Certificate Validation

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. Thi...

GHSA-P9CV-HRXR-FXX8 Restkit Does Not Validate TLS certificates

Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrapsocket function in Python with the default CERTNONE value for the certreqs argument...

IBM Sterling Secure Proxy 信任管理问题漏洞

IBM Sterling Secure Proxy is an application proxy used by International Business Machines Corporation IBM to secure the transfer of files in an organization's unprotected zone DMZ.IBM Sterling Secure Proxy version 6.0.3 and IBM Secure External Authentication Server version 6.0.3 contain a trust...

PT-2022-9929 · Ibm · Ibm Secure External Authentication Server +1

Name of the Vulnerable Software and Affected Versions: IBM Sterling Secure Proxy version 6.0.3 IBM Secure External Authentication Server version 6.0.3 Description: The issue arises from improper validation of certificates, which fails to ensure that a certificate is actually associated with the...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to improper validation of certificates

Summary IBM Sterling External Authentication Server does not properly ensure that a certificate is actually associated with the host due to improper validation of certificates. Vulnerability Details CVEID:CVE-2021-29726 DESCRIPTION: IBM Sterling Secure Proxy does not properly ensure that a...

Security Bulletin: IBM Sterling Secure Proxy is vulnerable to improper validation of certificates (CVE-2021-29726)

Summary IBM Sterling Secure Proxy does not properly ensure that a certificate is actually associated with the host due to improper validation of certificates. Vulnerability Details CVEID:CVE-2021-29726 DESCRIPTION: IBM Sterling Secure Proxy does not properly ensure that a certificate is actually...

CVE-2021-29726

IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3 does not properly ensure that a certificate is actually associated with the host due to improper validation of certificates. IBM X-Force ID: 201104...

PT-2022-7005

Name of the Vulnerable Software and Affected Versions Apple tvOS versions prior to 15.5 Apple iOS versions prior to 15.5 Apple iPadOS versions prior to 15.5 Apple watchOS versions prior to 8.6 Apple macOS Big Sur versions prior to 11.6.6 Apple macOS Monterey versions prior to 12.4 Apple macOS...

GHSA-CMXJ-WX9V-52QR Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL

Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

GHSA-273V-G3X4-R3RC Improper Certificate Validation in vt-ldap

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Improper Certificate Validation in vt-ldap

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Jenkins vSphere Plugin disables SSL/TLS certificate validation by default

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. vSphere Plugin 2.17 now has SSL/TLS certificate validation enabled by default...

Salt vulnerable to Improper Certificate Validation

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

GHSA-8J9G-C9RP-JVG4 Salt vulnerable to Improper Certificate Validation

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules...

Improper Certificate Validation in Microsoft .NET Framework components

A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework...

GHSA-P9WX-V264-Q34P Improper Certificate Validation in Microsoft .NET Framework components

A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework...

Jenkins Inedo BuildMaster Plugin globally and unconditionally disabled SSL/TLS certificate validation

A man in the middle vulnerability exists in Jenkins Inedo BuildMaster Plugin 1.3 and earlier in BuildMasterConfiguration.java, BuildMasterConfig.java, BuildMasterApi.java that allows attackers to impersonate any service that Jenkins connects to...