CVE-2017-17718

The Net::LDAP aka net-ldap gem before 0.16.0 for Ruby has Missing SSL Certificate Validation...

DEBIAN-CVE-2017-17718

The Net::LDAP aka net-ldap gem before 0.16.0 for Ruby has Missing SSL Certificate Validation...

CVE-2017-17718

CVE-2017-17718 concerns the Net::LDAP (net-ldap) Ruby gem, where versions before 0.16.0 lack proper SSL certificate validation. The connected IBM bulletin reiterates the same CVE description (Missing SSL Certificate Validation) and lists the vulnerability alongside CWE-295 and a IBM X-Force CVSS ...

CVE-2017-3194

Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

PortSwigger Web Security: Improper Certificate Validation

1 Obtained a key from PortSwigger official site. 2 Downloaded latest version of burp 1.7.29 from PortSwigger and activated license. 3 Downloaded previous version of burp v1.7.17 and used same key for the activation. And, I was able to activate license on the old version of BurpSuite. Impact Singl...

CVE-2017-8213

Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC201T, V500R002C00, V600R006C00 has an input validation vulnerability when handle TLS and DTLS handshake with certificate. Due to the...

NixOS NixOS LDAP SSL Certificate Validation Default Vulnerability

NixOS is a distribution of the Linux system. A security vulnerability exists in NixOS 17.03 and earlier versions. A remote attacker can exploit this vulnerability to conduct a man-in-the-middle attack and steal a user's password hash or service account credentials in plaintext...

CVE-2014-2845

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority...

Design/Logic Flaw

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority...

CVE-2014-2845

The CVE-2014-2845 entry applies to Cyberduck for Windows prior to 4.4.4, where the client does not properly validate X.509 certificate chains. This flaw allows MITM when using FTP-SSL because certificates issued by untrusted roots may be accepted. The NVD description and the SySS advisory confirm...

CVE-2014-2845

Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority...

Mitsui Sumitomo Insurance SumaHo application for Android certificate validation vulnerability

Mitsui Sumitomo Insurance SumaHo application for Android is an Android-based insurance product management application from Mitsui Sumitomo Insurance in Japan. A certificate validation vulnerability exists in versions 3.0.0 and earlier of the Mitsui Sumitomo Insurance SumaHo application for Androi...

CVE-2017-2912

An exploitable vulnerability exists in the remote control functionality of Circle with Disney running firmware 2.0.1. SSL certificates for specific domain names can cause the goclient daemon to accept a different certificate than intended. An attacker can host an HTTPS server with this certificat...

DEBIAN-CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

ALPINE-CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

CVE-2017-1000256

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default...

Twitter iOS client information disclosure vulnerability

Twitter iOS client is an iOS-based mobile client program for accessing the Twitter social network and micro blogs. A security vulnerability exists in versions 6.62 and 6.62.1 of the iOS-based Twitter client, which stems from the program failing to validate Twitter's server certificate. A remote...

Red Hat MRG ovirt-engine certificate validation security bypass vulnerability

Red Hat MRG is a suite of IT infrastructure platforms for integrated high-performance computing HPC from Red Hat, Inc. ovirt-engine is one of the open source virtualization management platform. A security vulnerability exists in ovirt-engine in Red Hat MRG version 3, which stems from the program'...

CVE-2017-6144

In F5 BIG-IP PEM 12.1.0 through 12.1.2 when downloading the Type Allocation Code TAC database file via HTTPS, the server's certificate is not verified. Attackers in a privileged network position may be able to launch a man-in-the-middle attack against these connections. TAC databases are used in...

Google Golang Go Certificate Validation Vulnerability

Google Golang Go is a programming language optimized for programming applications on multiprocessor systems by Google. A security vulnerability exists in Google Golang Go versions 1.7.3 and 1.6.3. A remote attacker can exploit this vulnerability to authenticate a connection with the help of...