CVE-2024-43201 Planet Fitness Workouts mobile apps do not properly validate TLS certificates

The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 released on 2024-07-25 a...

Planet Fitness Workouts 信任管理问题漏洞

Planet Fitness Workouts is a fitness-related application from Planet Fitness. A trust management issue vulnerability exists in Planet Fitness Workouts versions prior to 9.8.12 that stems from a failure to properly validate TLS certificates. An attacker could exploit the vulnerability to obtain...

AlmaLinux 9 : libnbd (ALSA-2024:6757)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:6757 advisory. libnbd: NBD server improper certificate validation CVE-2024-7383 Tenable has extracted the preceding description block directly from the AlmaLinux security advisor...

Oracle Linux 9 : libnbd (ELSA-2024-6757)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-6757 advisory. 1.18.1-4.0.1 - Add new content to nbdconnecturi.pod 1.18.1-4 - Fix CVE-2024-7383 NBD server improper certificate validation resolves: RHEL-52730 Tenable has...

libnbd security update

1.18.1-4.0.1 - Add new content to nbdconnecturi.pod 1.18.1-4 - Fix CVE-2024-7383 NBD server improper certificate validation resolves: RHEL-52730...

MongoDB Certificate Validation Vulnerability (SERVER-71477) - Windows

MongoDB is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...

CVE-2024-8287

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this...

CVE-2024-8287

Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this...

libnbd: NBD server improper certificate validation

A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic...

Moderate: Red Hat Security Advisory: libnbd security update

An update for libnbd is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Moderate: libnbd security update

Network Block Device NBD is a protocol for accessing Block Devices hard disks and disk-like devices over a Network. The libnbd is a userspace client library for writing NBD clients. Security Fixes: libnbd: NBD server improper certificate validation CVE-2024-7383 For more details about the securit...

PT-2024-38915 · Unknown · Anbox Stream Agent +1

Name of the Vulnerable Software and Affected Versions: Anbox Management Service versions 1.17.0 through 1.23.0 Description: The issue concerns the failure to validate the TLS certificate provided by the Anbox Stream Agent. This could be exploited by an attacker who can intercept the communication...

Improper Certificate Validation

libcurl.so is vulnerable to Improper Certificate Validation. The vulnerability is caused due to improper handling of OCSP responses, allowing an attacker to exploit the failure to correctly handle certain OCSP response statuses, such as "unauthorized," and mislead the system into accepting an...

The vulnerability in the TLS protocol implementation of the Firefox web browser relates to errors in the certificate validation process, which allows attackers to compromise data integrity.

The vulnerability in the implementation of the TLS protocol in the Firefox web browser is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

CVE-2024-8096

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error tha...

CVE-2024-8096 OCSP stapling bypass with GnuTLS

When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is valid, it might fail to detect some OCSP problems and instead wrongly consider the response as fine. If the returned status reports another error tha...

ROS-20240911-03

A vulnerability in the HTTP Requests library of the Python Requests programming language is related to ignoring the certificate validation. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data...

CVE-2024-7383

...

PT-2024-6616

Name of the Vulnerable Software and Affected Versions: curl versions prior to 8.10.0 Description: The issue is related to the improper validation of server certificates when using the Certificate Status Request TLS extension, also known as OCSP stapling. If the returned status reports an error...

CVE-2024-31489

AAn improper certificate validation vulnerability CWE-295 in FortiClientWindows 7.2.0 through 7.2.2, 7.0.0 through 7.0.11, FortiClientLinux 7.2.0, 7.0.0 through 7.0.11 and FortiClientMac 7.0.0 through 7.0.11, 7.2.0 through 7.2.4 may allow a remote and unauthenticated attacker to perform a...