CVE-2018-4991

Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable improper certificate validation vulnerability (CVE-2018-4991) that could lead to a security bypass. Affected product: Creative Cloud Desktop. Root cause: improper certificate validation. Impact: security b...

Cisco Warns of Three Critical Bugs in Digital Network Architecture Platform

Cisco Systems patched three bugs on Wednesday that are rated critical, tied to its Digital Network Architecture DNA Center platform. Cisco also warned of four additional vulnerabilities – each rated high. All of the vulnerabilities have available patches for mitigation. All three of the critical...

CVE-2018-0277

A vulnerability in the Extensible Authentication Protocol-Transport Layer Security EAP-TLS certificate validation during EAP authentication for the Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causi...

CVE-2018-0277

A vulnerability in the Extensible Authentication Protocol-Transport Layer Security EAP-TLS certificate validation during EAP authentication for the Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause the ISE application server to restart unexpectedly, causi...

CVE-2018-0277

CVE-2018-0277 affects Cisco ISE, ISE Express, and ISE Virtual Appliance. The issue is incomplete EAP-TLS certificate validation during EAP authentication, allowing a remote attacker to cause the ISE application server to restart and trigger DoS. Exploit involves initiating EAP-TLS with a crafted ...

Cisco Identity Services Engine Denial of Service Vulnerability

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform oversees the network by collecting real-time information from the network, users, and devices, and developing and enforcing policies accordingly.ISE Express...

Amazon Linux 2 : krb5 (ALAS-2018-1010)

Authentication bypass by improper validation of certificate EKU and SAN An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate...

Microsoft Azure IoT SDK Man-in-the-Middle Spoofing Vulnerability

Microsoft C, C and Java SDK for Azure IoT is a software development kit for developing Azure IoT Internet of Things platform applications based on the C, C and Java languages, respectively, from Microsoft Corporation, USA. A security vulnerability exists in the Microsoft C, C and Java SDK for Azu...

CVE-2018-8119

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C SDK, C SDK, Java SDK...

Microsoft .NET Framework Multiple Vulnerabilities (KB4095874)

This host is missing a critical security update according to Microsoft Security Updates KB4095874. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Siemens Siveillance VMS Video for Android and iOS Incorrect Certificate Validation Vulnerability

Siemens Siveillance VMS Video for Android is an Android-based video management software from Siemens, Germany. Siveillance VMS Video for iOS is an iOS-based version. A security vulnerability exists in Siveillance VMS Video prior to 12.1a 2018 R1 for Android-based platforms and Siveillance VMS Vid...

Adobe Patches Critical Bugs In Flash Player, Creative Cloud

Adobe has fixed several critical vulnerabilities – including a critical code execution bug in Adobe Flash Player – as part of its regularly scheduled May Security Bulletin, on Tuesday. In all, Adobe released patches for five critical and important vulnerabilities spanning Creative Cloud, Adobe...

Rooting a Logitech Harmony Hub: Improving Security in Today's IoT World

Introduction FireEye’s Mandiant Red Team recently discovered vulnerabilities present on the Logitech Harmony Hub Internet of Things IoT device that could potentially be exploited, resulting in root access to the device via SSH. The Harmony Hub is a home control system designed to connect to and...

CVE-2018-4849

A vulnerability has been identified in Siveillance VMS Video for Android All versions V12.1a 2018 R1, Siveillance VMS Video for iOS All versions V12.1a 2018 R1. Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypt...

CVE-2018-4849

A vulnerability has been identified in Siveillance VMS Video for Android All versions V12.1a 2018 R1, Siveillance VMS Video for iOS All versions V12.1a 2018 R1. Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypt...

Design/Logic Flaw

A vulnerability has been identified in Siveillance VMS Video for Android All versions V12.1a 2018 R1, Siveillance VMS Video for iOS All versions V12.1a 2018 R1. Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypt...

CVE-2018-4849

The CVE-2018-4849 vulnerability affects Siemens Siveillance VMS Video Mobile Apps for Android and iOS (versions before 12.1a 2018 R1). It stems from improper certificate validation, enabling a privileged network attacker to read and write data on the encrypted channel between the app and its serv...

CVE-2018-4849

A vulnerability has been identified in Siveillance VMS Video for Android All versions V12.1a 2018 R1, Siveillance VMS Video for iOS All versions V12.1a 2018 R1. Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypt...

ICSA-18-128-03 Siemens Siveillance VMS Video Mobile App

1. EXECUTIVE SUMMARY CVSS v3 4.8 ATTENTION : Exploitable remotely Vendor : Siemens Equipment : Siveillance VMS Video Mobile App Vulnerability : Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability may allow an attacker in a privileged network position...

Amazon Linux 2 : stunnel / amazon-efs-utils (ALAS-2018-996)

This update adds the checkHost option to stunnel, which verifies the host of the peer certificate subject. Certificates are accepted if no checkHost option was specified, or the host name of the peer certificate matches any of the hosts specified with checkHost. This update adds the OCSPaia optio...