CVE-2017-0129

Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for Mac Certificate Validation Vulnerability."...

CVE-2017-0129

Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for Mac Certificate Validation Vulnerability."...

Input validation

Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for Mac Certificate Validation Vulnerability."...

CVE-2017-0129

Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for Mac Certificate Validation Vulnerability."...

CVE-2017-0129

CVE-2017-0129 is a certificate-validation vulnerability in Microsoft Lync for Mac 2011. The flaw stems from improper X.509 certificate validation, enabling a remote attacker to tamper with TLS-secured communications (man‑in‑the‑middle) between server and client. Connected sources confirm the vuln...

Microsoft Lync for Mac Certificate Validation Vulnerability

A security feature bypass exists when the Lync for Mac 2011 client fails to properly validate certificates. An attacker who successfully exploited this vulnerability could tamper with trusted communications between the server and target client. To exploit the vulnerability, an attacker would need...

KLA10981 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to cause a denial of service, gain privileges, obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An improper sanitizing of a...

KLA10972 CIA hacking issue in Notepad++

An issue of a hijacked DLL was found in Notepad++. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a sciexer.dll, which is replaced by version of sciexer.dll built by CIA. Technical details This vulnerability has...

Code injection

The esetsdaemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not properly verify X.509 certificates from the edf.eset.com SSL server, which allows man-in-the-middle attackers to spoof this server and provide crafted responses ...

Invalid Authentication And Information Disclosure

dropwizard-auth-ldap is vulnerable to information disclosure. When TLS negotiation is not successful due to a failure in the certificate validation, the authenticate method on the LDAP server logs an error could not negotiate TLS. However, it also proceeds to pass the user credentials as plain te...

Remote Code Execution as Root via ESET Endpoint Antivirus 6（CVE-2016-9892）

Introduction ============ Per ESET's online material, "ESET Endpoint Antivirus for OS X delivers award- winning cross-platform protection for multi-platform environments. It protects against malware and spyware and shields end users from fake websites phishing for sensitive information such as...

QNAP QTS < 4.2.3 build 20170213 Multiple Vulnerabilities

QNAP QTS is prone to multiple vulnerabilities SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; if description...

QNAP QTS 4.2.x multiple Vulnerabilities

Exploit for hardware platform in category web applications QNAP QTS 4.2.x multiple vulnerabilities ======================================= The latest version of this advisory is available at: https://sintonen.fi/advisories/qnap-qts-42-multiple-vulnerabilities.txt Overview -------- QNAP QTS firmwa...

Fortinet FortiManager TLS Certificate Validation Failure (FG-IR-16-055)

Fortinet FortiManager is prone to a TLS certificate validation failure vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fortinet FortiManager Man-in-the-Middle Attack Vulnerability

Fortinet FortiManager is a centralized network security management platform from Fortinet. The platform supports centralized management of any number of Fortinet devices and can group devices into different management domains ADOM to further simplify multi-device security deployment and managemen...

IBM Tealeaf Customer Experience on Cloud Network Capture Add-On Information Disclosure Vulnerability

IBM Tealeaf Customer Experience is a SaaS Software-as-a-Service based web and mobile application analytics solution from IBM in the U.S. IBM Tealeaf Customer Experience on Cloud Network Capture Add-On is a hybrid cloud environment for the IBM IBM Tealeaf Customer Experience on Cloud Network Captu...

CVE-2016-2787

The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors...

CVE-2016-2787

CVE-2016-2787 affects Puppet Enterprise 2015.x (specifically 2015.3.x before 2015.3.3). The vulnerability arises from improper validation of broker node certificates in the Puppet Communications Protocol, enabling remote non-whitelisted hosts to prevent Puppet runs via unspecified vectors. The li...

Input validation

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...

CVE-2016-8495

An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...