Cisco Jabber for Windows Certificate Validation Vulnerability

A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, remote attacker to gain a man-in-the-middle position. The vulnerability is due to a failure to validate server certificates when negotiating a connection over Secure Sockets Layer SSL. An attacker could exploit this...

UBUNTU-CVE-2013-1909

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-1909

The CVE-2013-1909 issue affects the Python client in Apache Qpid prior to version 2.2, which does not verify that the server hostname matches the certificate’s CN/subjectAltName. This enables MITM with arbitrary valid certificates. Red Hat RHSA-2013:1024 notes upgrading to enable proper TLS/SSL c...

PHP 5.4.x < 5.4.19 Multiple Vulnerabilities

According to its banner, the version of PHP 5.4.x installed on the remote host is a version prior to 5.4.19. It is, therefore, potentially affected by the following vulnerabilities : - A heap corruption error exists in numerous functions in the file 'ext/xml/xml.c'. CVE-2013-4113 / Bug 65236 - An...

PHP 5.5.x < 5.5.3 Multiple Vulnerabilities

According to its banner, the version of PHP 5.5.x installed on the remote host is a version prior to 5.5.3. It is, therefore, potentially affected by the following vulnerabilities : - An error exists related to the 'Sessions' subsystem that can allow an attacker to hijack the session of another...

PT-2013-4915 · Python +3 · Python +3

Name of the Vulnerable Software and Affected Versions: Python versions 2.6 through 3.4 Description: The issue arises from the ssl.match hostname function in the SSL module, which fails to properly handle a '0' character in a domain name in the Subject Alternative Name field of an X.509 certificat...

Oracle Linux 6 : freeradius (ELSA-2012-1326)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-1326 advisory. 2.1.12-4 - resolves: bug855316 CVE-2012-3547 freeradius: Stack-based buffer overflow by processing certain expiration date fields of a certificate during x509...

Oracle Linux 5 : freeradius2 (ELSA-2013-0134)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0134 advisory. 2.1.12-5 - resolves: bug855308 CVE-2012-3547 freeradius: Stack-based buffer overflow by processing certain expiration date fields of a certificate during x509...

Moderate: Red Hat Security Advisory: Red Hat Enterprise MRG Messaging 2.3.3 security update

Updated Messaging component packages that fix one security issue and multiple bugs are now available for Red Hat Enterprise MRG 2.3 for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CV...

Apple iTunes Multiple Vulnerabilities (Jun 2013) - Windows

Apple iTunes is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apple:itunes"; ifdescription...

python-httplib insufficient certificate validation

Certificate is only validated on first request...

[ MDVSA-2013:168 ] python-httplib2

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2013:168 http://www.mandriva.com/en/support/security/ Package : python-httplib2 Date : May 27, 2013 Affected: Business Server 1.0 Problem Description: Updated python-httplib2 packages fix security vulnerability:...

Oracle Java Security Enhancements Get Mixed Reviews

Oracle is working hard to restore some faith in the security of the Java browser plug-in with a number of enhancements announced yesterday, specifically to in-house code testing, as well as policy changes regarding signed applets and certificate validation. But after a miserable year of targeted...

Apple iTunes multiple security vulnerabilities

Certificate validation vulnerability, multiple memory corruptions...

APPLE-SA-2013-05-16-1 iTunes 11.0.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2013-05-16-1 iTunes 11.0.3 iTunes 11.0.3 is now available and addresses the following: iTunes Available for: Mac OS X v10.6.8 or later, Windows 7, Vista, XP SP2 or later Impact: An attacker in a privileged network position may manipulate HTTP...

CVE-2007-6746

CVE-2007-6746 affects telepathy-idle before 0.1.15, where SSL certificate validation is incomplete: (1) issuer trusted-CA check bypassed, (2) hostname not strictly validated against CN, and (3) certificate expiration date not verified. This enables potential MITM attacks by presenting arbitrary v...

iTunes < 11.0.3 Multiple Vulnerabilities

Binary data 6831.prm...

Apple iTunes < 11.0.3 Multiple Vulnerabilities (credentialed check)

The version of Apple iTunes installed on the remote Windows host is older than 11.0.3. It therefore is potentially affected by several issues : - An error exists related to certificate validation that could allow disclosure of sensitive information and could allow the application to trust data fr...

Apple iTunes < 11.0.3 Multiple Vulnerabilities (uncredentialed check)

The version of Apple iTunes on the remote host is prior to version 11.0.3. It is, therefore, affected by multiple vulnerabilities : - An error exists related to certificate validation. A man-in-the-middle attacker can exploit this to spoof HTTPS servers, which allows the disclosure of sensitive...

iTunes < 11.0.3 Certificate Validation Vulnerability (Mac OS X)

The version of iTunes installed on the remote Mac OS X host is earlier than 11.0.3 and is, therefore, affected by an information disclosure vulnerability related to certificate validation. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66500; scriptversion"1.8";...