Apple iOS X.509 Certificate Validation Vulnerability

IOS is an operating system developed by Apple for mobile devices. A certificate validation vulnerability exists in Apple iOS X.509, which allows attackers to bypass security restrictions to obtain sensitive information, execute arbitrary code, or launch other attacks such as denial of service...

Oracle MySQL 5.6.x < 5.6.26 Multiple Vulnerabilities (October 2015 CPU)

The version of Oracle MySQL installed on the remote host is 5.6.x prior to 5.6.26. It is, therefore, affected by the following vulnerabilities : - A certificate validation bypass vulnerability exists in the Security:Encryption subcomponent due to a flaw in the X509verifycert function in x509vfy.c...

Amazon Linux AMI : java-1.7.0-openjdk (ALAS-2015-605)

Multiple flaws were discovered in the CORBA, Libraries, RMI, Serialization, and 2D components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. CVE-2015-4835 , CVE-2015-4881 , CVE-2015-4843 , CVE-2015-4883 , CVE-2015-4860 ,...

HP ArcSight SmartConnector fails to properly validate SSL and contains a hard-coded password

Overview The HP ArcSight SmartConnector fails to properly validate SSL certificates, and also contains a hard-coded password. Description CWE-295: Improper Certificate Validation - CVE-2015-2902The ArcSight SmartConnector fails to validate the certificate of the upstream Logger device it is...

MySQL 5.6.x < 5.6.27 Multiple Vulnerabilities

The version of MySQL running on the remote host is 5.6.x prior to 5.6.27. It is, therefore, potentially affected by the following vulnerabilities : - A certificate validation bypass vulnerability exists in the Security:Encryption subcomponent due to a flaw in the X509verifycert function in...

Oracle Linux 6 / 7 : java-1.7.0-openjdk (ELSA-2015-1920)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1920 advisory. 1:1.7.0.91-2.6.2.2.0.1 - Update DISTRONAME in specfile 1:1.7.0.91-2.6.2.2 - added and applied patch500 8072932or8074489.patch to fix tck failure -...

Webroot SecureAnywhere Business Mobile Protection SSL Certificate Validation Security Bypass Vulnerability

Webroot SecureAnywhere Business Mobile Protection is a suite of enterprise-grade antivirus software from Webroot USA. A security bypass vulnerability exists in Webroot SecureAnywhere Business Mobile Protection version 1.10.316 and earlier versions, which can be exploited by an attacker to conduct...

Cisco Spark Certificate Validation Information Disclosure Vulnerability

Cisco Spark is a collaboration services solution. Cisco Spark suffers from a security vulnerability where the program fails to properly validate X.509 certificates on the server side of SSL, allowing a remote attacker to perform a man-in-the-middle attack using specially crafted certificates to...

The Apple watch watchOS 2 Update: fixed a lot of code execution vulnerability-vulnerability warning-the black bar safety net

Make the fans excited watchOS 2 is finally here, this is one you can build a watch system, while the new version a lot of security patches. Overdue watchOS 2 Originally scheduled for 9 May 1 6 May and the fruit to meet Apple watch, the new system watchOS 2, because of the sudden discovery of...

VMware vCenter 5.5 LDAP Certificate Validation MitM Spoofing (VMSA-2015-0006)

The VMware vCenter Server installed on the remote host is version 5.5 prior to 5.5u3. It is, therefore, affected by a man-in-the-middle spoofing vulnerability due to improper validation of X.509 certificates from TLS LDAP servers. A remote, man-in-the-middle attacker can exploit this to intercept...

Cisco Prime Security Manager OpenSSL Alternative Chains Certificate Forgery (cisco-sa-20150710-openssl)

According to its self-reported version number, the version of Cisco Prime Security Manager installed on the remote host has a bundled version of OpenSSL that is affected by a certificate validation bypass vulnerability. The vulnerability exists due to a flaw in the X509verifycert function in...

Cisco ASA Next-Generation Firewall OpenSSL Alternative Chains Certificate Forgery (cisco-sa-20150710-openssl)

The remote ASA Next-Generation Firewall NGFW host is missing a security patch. It is, therefore, affected by a certificate validation bypass vulnerability in the bundled version of OpenSSL. The vulnerability exists due to a flaw in the X509verifycert function in x509vfy.c that is triggered when...

Apple watchOS2 security patches

Apple today brought a smile to the face of gadget geeks with the release of watchOS2, and for the second time in five months, a new version of the Apple Watch operating system brought with it a flurry of security patches. This round includes more than a dozen code execution vulnerabilities in a...

Improper validation of certificates when using self-signed certificates - ownCloud

The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates. To be exploitable the following conditions have to be met: The connection to the remote ownCloud server must be secured using a self-signed certificate which the user...

Improper validation of certificates when using self-signed certificates 2.0.1

The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates. To be exploitable the following conditions have to be met:...

Siemens COMPAS移动应用的错误证书验证

No description provided by source...

Apple iOS NSURL Certificate Validation Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS has a certificate validation vulnerability in NSURL when the certificate is changed, allowing attackers in a privileged network location to intercept SSL/TLS links...

VMware vCenter Server LDAP Certificate Validation Bypass Vulnerability

VMware vCenter Server provides centralized visibility, proactive management and extensibility into virtual infrastructures. VMware vCenter Server fails to validate TLS certificates when binding to LDAP servers, allowing an attacker to intercept communications between an LDAP server and a target...

VMware Releases Security Update

VMware has released a security update to address a Lightweight Directory Access Protocol LDAP certificate validation vulnerability in vCenter Server. Exploitation of this vulnerability may allow an attacker to obtain sensitive information. Available updates include: VMware vCenter Server version...

KLA10665 Obtain sensitive information vulnerability in VMware vCenter Server

Improper certificate validation was found in VMware vCenter Server. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a traffic interception. Technical details This vulnerability can be exploited when vCenter Server...