CVE-2021-29656

Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked...

Design/Logic Flaw

Pexip Infinity Connect before 1.8.0 mishandles TLS certificate validation. The allow list is not properly checked...

CVE-2021-29656

CVE-2021-29656 affects Pexip Infinity Connect (versions prior to 1.8.0). The root cause is improper TLS certificate validation and failure to properly check the allow list, as described in multiple sources. Impact is described as partial confidentiality, integrity, and availability losses (per CV...

CVE-2022-23649 Improper Certificate Validation in Cosign

Cosign provides container signing, verification, and storage in an OCI registry for the sigstore project. Prior to version 1.5.2, Cosign can be manipulated to claim that an entry for a signature exists in the Rekor transparency log even if it doesn't. This requires the attacker to have pull and...

Improper Certificate Validation

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Certificate Validation. Go Vulnerability Report: On Windows, if VerifyOptions.Roots is nil, Certificate.Verify does not check the EKU requirements specified in...

Improper Certificate Validation

cn.hutool:hutool-http is vulnerable to Improper certificate validation. The vulnerability exists due to the insufficient validations of TLS/SSL certificates in verify function in TrustAnyHostnameVerifierof class...

GHSA-P7W9-8MXW-P3G7 Improper Certificate Validation in Hutool

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Improper Certificate Validation in Hutool

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Improper Certificate Validation

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket

Impact If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults. When looking up a WSS endpoint using the DNS TXT record method described in XEP-0156: Discovering Alternative XMPP Connection Methods the ServerName field...

CVE-2022-22885

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Design/Logic Flaw

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

CVE-2022-22885

CVE-2022-22885 affects Hutool v5.7.18: Hutool.HttpRequest incorrectly ignores TLS/SSL certificate validation, creating a trust-management vulnerability that enables network-based MITM attacks. CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with base score 9.8; CVSS2.0 also 7.5. Exploitation details ...

CVE-2022-22885

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

PT-2022-15716 · Hutool · Hutool

Name of the Vulnerable Software and Affected Versions: Hutool version 5.7.18 Description: The issue concerns the ignoring of all TLS/SSL certificate validation in Hutool's HttpRequest. Recommendations: For Hutool version 5.7.18, update to a version that properly validates TLS/SSL certificates to...

Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket

If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults...

Vulnerability of the Node.js software platform’s Relative Distinguished Name (RDN) component, which allows attackers to perform spoofing attacks

The vulnerability of the Relative Distinguished Name RDN component in the Node.js software platform is related to errors in the certificate validation process. Exploiting this vulnerability allows attackers to perform spear-phishing attacks remotely...

The vulnerability of the implementation of the method for specifying all domain names and IP addresses in the Node.js software platform allows attackers to perform spoofing attacks.

The vulnerability of the method for specifying all domain names and IP addresses on the Node.js software platform is related to errors in the X.509 certificate validation process. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

The vulnerability of the implementation for specifying all domain names and IP addresses using Subject Alternative Names in the Node.js software platform allows attackers to perform spoofing attacks.

The vulnerability of the method for specifying all domain names and IP addresses in a Node.js software platform is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to perform spoofing attacks remotely...

Hutool 安全漏洞

Hutool is a small but comprehensive Java tools library from the Chinese Dromara community. Hutool suffers from a trust management issue vulnerability that stems from Hutool v5.7.18's HttpRequest was found to ignore all TLS/SSL certificate validations...