8078 matches found
Code injection
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. Thi...
CVE-2016-9015
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. Thi...
nodejs: wildcard certificates not properly validated
It was found that Node.js' tls.checkServerIdentity function did not properly validate server certificates containing wildcards. A malicious TLS server could use this flaw to get a specially crafted certificate accepted by a Node.js TLS client...
Cisco Email Security Appliance AsyncOS Software Update Server Certificate Validation Vulnerability
A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Email Security Appliance ESA could allow an unauthenticated, remote attacker to impersonate the update server. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced...
Cisco Web Security Appliance AsyncOS Software Update Server Certificate Validation Vulnerability
A vulnerability in the update functionality of Cisco AsyncOS Software for Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to impersonate the update server. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced source...
PT-2021-7507 · Saltstack +3 · Saltstack Salt +3
Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 3002.5 Description: The issue is related to errors in the SSL certificate validation procedure during authentication to services using certain modules. This can allow a remote attacker to perform a...
PT-2021-2235 · Saltstack +4 · Saltstack Salt +6
Name of the Vulnerable Software and Affected Versions: SaltStack Salt versions prior to 3002.5 Description: The issue is related to errors in the certificate authentication procedure on vCenter, vSphere, and ESXi servers. This can allow a remote attacker to perform a "man-in-the-middle" attack. T...
Google Removing SHA-1 Support in Chrome 56
The home stretch for SHA-1 deprecation is in full effect with Google on Wednesday announcing its final deprecation deadlines for the Chrome browser, and a cryptographic services provider warning that there’s still a long way to go to get sites off SHA-1 certificates. Google said it will remove it...
Digium Asterisk Denial of Service Vulnerability
Digium Asterisk is a set of open source telephone exchange PBX system software from Digium, USA. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR and so on. A security vulnerability exists in Digium Asterisk. An attacker could exploit the vulnerabili...
Red Hat OpenShift Enterprise Security Bypass Vulnerability
Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. A security vulnerability exists in Red Hat OpenShift Enterprise that stems from the...
HP System Management Homepage < 7.6 Multiple Vulnerabilities (HPSBMU03653) (httpoxy)
According to its banner, the version of HP System Management Homepage SMH hosted on the remote web server is prior to 7.6. It is, therefore, affected by the following vulnerabilities : - A heap buffer overflow condition exists in OpenSSL in the EVPEncodeUpdate function within file...
Yelp: X.509 certificate validation fails on international vanity domains
This is not an vulnerability, more likely TLS/SSL related configuration issue with certificates noticed during bug bounty testing. If you try to access any Finnish domain such as my HackerOne test-profile http://tomitest.yelp.fi/, there will be an certificate related error presented to user. You...
Magento Community Edition < 1.9.3 Multiple Vulnerabilities
Binary data 8963.prm...
Python urllib3 TLS certificate validation security bypass vulnerability
Python is an open source, object-oriented programming language from the Python Software Foundation. A TLS certificate validation security bypass vulnerability exists in versions 1.17 and 1.18 of the urllib3 library for Python, which could allow an attacker to perform a man-in-the-middle attack or...
Shotwell is vulnerable
Shotwell is a Linux-based photo management software for the GNOME desktop environment. A security vulnerability exists in Shotwell version 0.22.0. The program fails to validate TLS and SSL certificates. An attacker can exploit this vulnerability to conduct a man-in-the-middle attack...
Debian DSA-3700-1 : asterisk - security update
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...
[SECURITY] [DSA 3700-1] asterisk security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3700-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 25, 2016 https://www.debian.org/security/faq -...
DEBIAN-CVE-2016-1000033
Shotwell version 0.22.0 and possibly other versions is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks...