CVE-2017-7726

iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability...

Huawei SMC2.0 Denial of Service Vulnerability

Huawei SMC2.0 is a video management solution from Huawei, China. The solution supports both H.323 and SIP protocols, and supports access from computers and cell phones. A denial of service vulnerability exists in Huawei SMC2.0, which originates from the program failing to adequately validate...

Samsung Magician Remote Code Execution Vulnerability

Samsung Magician is software for Samsung SSDs that provides performance testing, performance optimization, and firmware upgrades for SSDs. A remote code execution vulnerability exists in Samsung Magician due to the program failing to properly validate TLS certificates for HTTPS software update...

CVE-2017-3218

Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates...

LBTC Mobile Information Disclosure Vulnerability

LBTC Mobile is a banking service that you can access anytime, anywhere. Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS The app fails to validate X.509 certificates for SSL servers, allowing man-in-the-middle attackers to spoof servers and gain access to sensitive information by...

Wawa Employees Credit Union Mobile Information Disclosure Vulnerability

Wawa Employees Credit Union Mobile allows you to bank anywhere, anytime. Wawa Employees Credit Union Mobile for iOS fails to validate SSL servers with X.509 certificates, allowing man-in-the-middle attackers to spoof servers and gain access to sensitive information by crafting certificates...

MEA Financial Vision Bank Information Disclosure Vulnerability

Vision Bank offers you the convenience of enjoying online banking services through your cell phone. MEA Financial vision-bank/id420406345 app 3.0.1 for iOS fails to validate SSL servers with X.509 certificates, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information...

CVE-2017-9599

The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2017-9594

The "SVB Mobile" by Sauk Valley Bank Mobile Banking app 3.0.0 -- aka svb-mobile/id796429885 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9575

The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9580

The "Pioneer Bank & Trust Mobile Banking" by PIONEER BANK AND TRUST app 3.0.0 -- aka pioneer-bank-trust-mobile-banking/id603182861 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2017-9599

The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2016-5648

Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate...

CVE-2016-5648

The Acer Portal Android app (versions 3.9.3.2003–3.9.3.2006) is affected by CVE-2016-5648 due to improper SSL certificate validation, allowing remote MITM attacks and potential credential exposure when connecting to Acer Cloud. Impact is a credential/theory exposure via unauthenticated, network-b...

DEBIAN-CVE-2017-9022

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpzpowmsec, which allows remote peers to cause a denial of service floating point exception and process crash via a crafted certificate...

About the security content of macOS Sierra 10.12.5, Security Update 2017-002 El Capitan, and Security Update 2017-002 Yosemite - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

NXP i.MX Product Family

CVSS v3 6.0 REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on June 1, 2017, and is being released to the NCCIC/ICS-CERT web site. AFFECTED PRODUCTS The following i.MX Devices, used on logic boards, are affected: Devices affected by the Stack Buffer Overflow...

Scientific Linux Security Update : nss on SL6.x i386/x86_64 (20170530)

Security Fixes : - A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. CVE-2017-7502 Bug Fixes : - The Network Security Services NSS code and Certificate Authority CA...

Design/Logic Flaw

Apache Hive JDBC + HiveServer2 implements SSL for plain TCP and HTTP connections it supports both transport modes. While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name...

CVE-2016-3083

CVE-2016-3083 affects Apache Hive JDBC/HiveServer2: SSL is used for plain TCP and HTTP, but the client may fail to verify the certificate’s common name during the SSL handshake in Hive versions before 1.2.2 and 2.0.x before 2.0.1. This can allow a server presenting a valid CA-signed cert for a di...