CVE-2024-27323

PDF-XChange Editor Updater suffers from improper certificate validation in its update functionality, enabling network-adjacent attackers to execute arbitrary code with the current user’s privileges without user interaction. Affected software: PDF-XChange Editor (Updater component). Root cause: se...

CVE-2024-27323 PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability

PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is not required to exploit this vulnerability. The...

MGASA-2024-0102 Updated squid packages fix security vulnerabilities

Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squ...

Serverpod client accepts any certificate

This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic an...

CVE-2024-29887

CVE-2024-29887 affects the Serverpod client component of Serverpod (serverpod_client), where TLS certificate validation is bypassed in non-web HTTP clients. The root cause is improper certificate validation, enabling potential man-in-the-middle attacks on encrypted traffic between client devices ...

Curl 安全漏洞

Curl is a tool for transferring data from or to a server. A security vulnerability exists in Curl versions 8.6.0 through 8.6.0 that stems from the fact that libcurl skips certificate validation for QUIC connections under certain conditions when using WolfSSL...

PT-2024-22619 · Stork · Stork

Name of the Vulnerable Software and Affected Versions: Stork versions 0.15.0 through 1.15.0 Description: The TLS certificate validation code is flawed, allowing an attacker to obtain a TLS certificate from the Stork server and use it to connect to the Stork agent. Once connected, the attacker can...

Curl 安全漏洞

Curl is a tool for transferring data from or to a server. A security vulnerability exists in Curl versions 8.5.0 through 8.6.0 that stems from bypassing TLS certificate checking when using mbedTLS...

PT-2025-16951 · Dell · Dell Ecs

Name of the Vulnerable Software and Affected Versions: Dell ECS versions 3.8.1.4 and prior Description: The issue is related to an Improper Certificate Validation, which could be exploited by an unauthenticated attacker with adjacent network access, potentially leading to information disclosure...

FreeBSD : databases/mongodb* -- Improper Certificate Validation (a8448963-e6f5-11ee-a784-dca632daf43b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a8448963-e6f5-11ee-a784-dca632daf43b advisory. - Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate...

GnuTLS 安全漏洞

GnuTLS is a free secure communications library for implementing the SSL, TLS and DTLS protocols. A security vulnerability exists in GnuTLS that stems from an attempt to validate a specially crafted pem package using the certtool --verify-chain command, which may cause the application to crash...

SolarEdge mySolarEdge 安全漏洞

SolarEdge mySolarEdge is a monitoring application for residential and commercial PV system owners from SolarEdge, Inc. A security vulnerability exists in SolarEdge mySolarEdge versions prior to 2.20.1 that stems from the application failing to properly validate TLS server certificates...

PT-2024-3221

Name of the Vulnerable Software and Affected Versions Apache Airflow FTP Provider versions prior to 3.7.0 Description The issue is related to improper certificate validation in FTP TLS connections, which can potentially be leveraged by an attacker. This can impact the confidentiality, integrity,...

The vulnerability of HashiCorp’s Vault and Vault Enterprise archiving platforms relates to errors in the certificate validation process. This allows attackers to bypass the authentication process.

The vulnerability of the HashiCorp Vault and Vault Enterprise archiving platforms relates to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to bypass the authentication process...

Apache Airflow Trust Management Issues Vulnerability (CNVD-2024-13571)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from a trust management issue vulnerability that stems from...

MGASA-2024-0056 Updated java-17-openjdk packages fix security vulnerabilities

The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. Security Fixes: OpenJDK: memory corruption issue on x8664 with AVX-512 8317121 CVE-2023-22025 OpenJDK: certificate path validation issue during client authentication...

The vulnerability of the MongoDB database management system is related to errors in the TLS certificate validation process, which allows a perpetrator to establish unauthorized connections to the MongoDB server.

The vulnerability of the MongoDB database management system is related to errors in the TLS certificate validation process. Exploiting this vulnerability allows an attacker to establish unauthorized connections to the MongoDB server remotely...

Advisory ROSA-SA-2024-2372

Software: openldap 2.4.46 OS: ROSA Virtualization 2.1 packageevrstring: openldap-2.4.46-10.el8.src.rpm CVE-ID: CVE-2020-15719 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: libldap in some third-party OpenLDAP packages has a certificate validation error when the third-party package asserts support for...

The vulnerability of the data image management software in the Veritas NetBackup Snapshot Manager environment, related to errors in the certificate validation process, allows a perpetrator to interact with the RabbitMQ service.

The vulnerability of the data image management software in the context of Veritas NetBackup Snapshot Manager lies in errors related to the authentication process. Exploiting this vulnerability allows an attacker to interact with the RabbitMQ service remotely...

MongoDB Certificate Validation Vulnerability (SERVER-72839) - Windows

MongoDB is prone to a certificate validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mongodb:mongodb"; if...