Keycloak vulnerable to Improper Certificate Validation

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity. This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0...

GHSA-RPJ2-W6FR-79HC Keycloak vulnerable to Improper Certificate Validation

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity. This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0...

Splunk Enterprise 9.0.0 < 9.0.1 (SVD-2022-0801)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2022-0801 advisory. - When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS...

Exploit for Improper Certificate Validation in Microsoft

CVE-2022-26923-Powershell-POC A powershell poc to load and aut...

CVE-2022-37437

When using Ingest Actions to configure a destination that resides on Amazon Simple Storage Service S3 in Splunk Web, TLS certificate validation is not correctly performed and tested for the destination. The vulnerability only affects connections between Splunk Enterprise and an Ingest Actions...

CVE-2022-37437

Summary: CVE-2022-37437 affects Splunk Enterprise 9.0.0 when using Ingest Actions to configure an S3 destination via Splunk Web. The root cause is that TLS certificate validation is not correctly performed and tested for the destination, and this only impacts connections through Splunk Web with T...

Splunk 信任管理问题漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

Fortinet FortiClient 信任管理问题漏洞

Fortinet FortiClient is a mobile endpoint security solution from Fortinet. The solution provides IPsec and SSL encryption, WAN optimization, endpoint compliance, and two-factor authentication when connected to a FortiGate firewall appliance. A trust management issue vulnerability exists in Fortin...

Splunk Enterprise and Universal Forwarder < 9.0 Improper Certificate Validation

In Splunk Enterprise and Universal Forwarder versions before 9.0, the Splunk command-line interface CLI did not validate TLS certificates while connecting to a remote Splunk platform instance by default. Splunk peer communications configured properly with valid certificates were not vulnerable...

Improper Certificate Validation

libreoffice is vulnerable to an Improper Certificate Validation vulnerability. The vulnerability exists where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificat potentially...

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD, related to errors in the certificate validation process, allows attackers to perform spear-phishing attacks.

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks remotely...

F5 BIG-IP Traffic Intelligence Feeds Certificate Validation Error Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A certificate validation error vulnerability exists in F5 BIG-IP Traffic Intelligence Feeds, which can be exploited by...

LibreOffice < 7.2.7 / 7.3.2 Improper Certificate Validation (macOS)

According to its self-reported version, the LibreOffice application running on the remote host is prior to 7.2.7 or 7.3.2. It is, therefore, affected by an Improper Certificate Validation vulnerability where determining if a macro was signed by a trusted author was done by only matching the seria...

F5 BIG-IP 信任管理问题漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A certificate validation error vulnerability exists in F5 BIG-IP Traffic Intelligence Feeds, which can be exploited by...

LibreOffice < 7.2.7 / 7.3.2 Improper Certificate Validation (Windows)

According to its self-reported version, the LibreOffice application running on the remote host is prior to 7.2.7 or 7.3.2. It is, therefore, affected by an Improper Certificate Validation vulnerability where determining if a macro was signed by a trusted author was done by only matching the seria...

The vulnerability of the TLS and SSL protocols used by Cisco Nexus Dashboard for analyzing and automating cloud network operations stems from errors in the certificate validation process. This allows attackers to access confidential information or alter data.

The vulnerability of the TLS and SSL protocols used in Cisco Nexus Dashboard, a platform for analytics and automation of cloud network operations, is related to errors in the certificate validation process. Exploiting this vulnerability can allow an attacker to gain access to confidential...

Improper Certificate Validation

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Certificate Validation. Go Vulnerability Report: A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use.A...

GO-2022-0535 Certificate validation bypass on Windows in crypto/x509

A Windows vulnerability allows attackers to spoof valid certificate chains when the system root store is in use. A workaround is present in Go 1.12.6+ and Go 1.13.7+, but affected users should additionally install the Windows security update to protect their system. See...

Improper Certificate Validation

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...

Improper Certificate Validation

fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode TLSSocket using fs2-io on Node.js, the parameter requestCert = true is ignored, peer certificate verification is skipped, and the connection proceeds. The vulnerability is limited to: 1. fs2-io running on...