Exploit for Improper Certificate Validation in Apple Iphone_Os

OS X/iOS SSL Flaw POC Overview This repository contains s...

Apple iOS 7.x < 7.0.6 'SSLVerifySignedServerKeyExchange' Certificate Validation Weakness

Binary data appleios706check.nbin...

Apple iOS 6.x < 6.1.6 'SSLVerifySignedServerKeyExchange' Certificate Validation Weakness

Binary data appleios616check.nbin...

SSL Vulnerability Affects OSX Too

The certificate-validation vulnerability that Apple patched in iOS yesterday also affected Mac OS X up to 10.9.1, the current version. Several security researchers analyzed the patch and looked at the code in question in OS X and found that the same error exists there as in iOS. Researcher Adam...

Apple Fixes Certificate Validation Flaw in iOS

Apple on Friday quietly pushed out a security update to iOS that restores some certificate-validation checks that had apparently been missing from the operating system for an unspecified amount of time. Apple released iOS 7.06 on Friday and the only content in the update was a small security fix...

Google Chrome < 33.0.1750.117 Multiple Vulnerabilities

The version of Google Chrome installed on the remote host is a version prior to 33.0.1750.117. It is, therefore, affected by the following vulnerabilities : - An error exists related to relative path in Windows sandbox named pipe policy. CVE-2013-6652 - Use-after-free errors exist related to...

Google Chrome < 33.0.1750.117 Multiple Vulnerabilities (Mac OS X)

The version of Google Chrome installed on the remote Mac OS X host is a version prior to 33.0.1750.117. It is, therefore, affected by the following vulnerabilities : - Use-after-free errors exist related to handling web components and layout. CVE-2013-6653, CVE-2013-6655, CVE-2013-6658 - A castin...

Phony SSL Certs Spoof Google, Facebook, GoDaddy, others

Dozens of phony SSL certificates were discovered this week mocking legitimate certs from banks, e-commerce sites, ISPs and social networks. If a user stumbled over one of the bogus certificates on a mobile device it could put them at risk for a man-in-the-middle attack. Disguised as official...

Hackers targeting non-browser applications with Fake SSL Certificates

Having SSL Certification doesn't mean that the website you are visiting is not a bogus website. SSL certificates protect web users in two ways, it encrypts sensitive information such as usernames, passwords, or credit card numbers and also verify the identity of websites. But today hackers and...

CVE-2013-2191

python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate...

PYSEC-2014-88

python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate...

CVE-2013-2191

python-bugzilla before 0.9.0 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate...

PT-2014-2570 · Python · Python-Bugzilla

Name of the Vulnerable Software and Affected Versions: python-bugzilla versions prior to 0.9.0 Description: The issue allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate because it does not validate X.509 certificates. Recommendations: For versions prior to 0.9....

CVE-2013-7304

CVE-2013-7304 affects Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5. The root cause is that X.509 certificate validation is not configured for client devices, enabling attackers to perform a man-in-the-middle by presenting an arbitrary certificate during a client session. No re...

CVE-2013-7304

Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client...

[Watcher] passive Web-security scanner

Watcher is a runtime passive-analysis tool for HTTP-based Web applications. Being passive means it won't damage production systems, it's completely safe to use in Cloud computing, shared hosting, and dedicated hosting environments. Watcher detects Web-application security issues as well as...

Amazon Linux AMI : nss (ALAS-2013-265)

A flaw was found in the way NSS handled invalid handshake packets. A remote attacker could use this flaw to cause a TLS/SSL client using NSS to crash or, possibly, execute arbitrary code with the privileges of the user running the application. CVE-2013-5605 It was found that the fix for...

Endpoint Security MI Server R73 certificate validation

...

Firefox < 26.0 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox is earlier than 26.0 and is, therefore, potentially affected by multiple vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - An issue exists where the...

Firefox ESR 24.x < 24.2 Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox ESR 24.x is earlier than 24.2 and is, therefore, potentially affected by the following vulnerabilities : - Memory issues exist in the browser engine that could result in a denial of service or arbitrary code execution. CVE-2013-5609, CVE-2013-5610 - Two...