7654 matches found
Design/Logic Flaw
VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate...
OpenSSH Certificate Validation Security Bypass Vulnerability
OpenSSH is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openbsd:openssh";...
cURL/libcURL 7.x < 7.35.0 Multiple Vulnerabilities
Binary data 8178.prm...
Chromium / Google Chrome multiple security vulnerabilities
Memory corruprions, information leakage, certificate validation issues, protection bypass, crossite scripting, directory traversal...
IP address wildcard certificate validation
libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses. RFC 2818 covers the requirements for matching Common Names CNs and subjectAltNames in order to establish valid SSL connections. It first discusses CNs that are for hostnames, and the rules for wildcards in th...
not verifying certs for TLS to IP address / Schannel
When asked to do a TLS connection HTTPS, FTPS, IMAPS, etc to a URL specified with an IP address instead of a name, libcurl would wrongly not verify the server's name in the certificate. The signature whether it was signed by a trusted CA and validity whether the date was within the certificate's...
CVE-2014-1492
The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...
cURL/libcURL SSL证书验证安全限制绕过漏洞
BUGTRAQ ID: 66296 CVE ID: CVE-2014-2522 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL/libcURL在服务器证书的验证上存在安全漏洞，成功利用后可导致中间人攻击或服务器欺骗。 0 cURL 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://curl.haxx.se/...
GnuTLS certificate validation bypass
Invalid error handling...
SuSE Update for gnutls openSUSE-SU-2014:0325-1 (gnutls)
Check for the Version of gnutls OpenVAS Vulnerability Test $Id: gbsuse201403251.nasl 8044 2017-12-08 08:32:49Z santu $ SuSE Update for gnutls openSUSE-SU-2014:0325-1 gnutls Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program i...
SuSE Update for gnutls openSUSE-SU-2014:0346-1 (gnutls)
Check for the Version of gnutls OpenVAS Vulnerability Test $Id: gbsuse201403461.nasl 8044 2017-12-08 08:32:49Z santu $ SuSE Update for gnutls openSUSE-SU-2014:0346-1 gnutls Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program i...
openSUSE: Security Advisory for gnutls (openSUSE-SU-2014:0328-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
gnutls: fixed SSL certificate validation (critical)
The gnutls library was updated to fix SSL certificate validation. Remote man-in-the-middle attackers were able to make the verification believe that a SSL certificate is valid even though it was not...
[slackware-security] gnutls
New gnutls packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue. Here are the details from the Slackware 14.1 ChangeLog: patches/packages/gnutls-3.1.22-i486-1slack14.1.txz: Upgraded. Fixed a security issue where a specially crafted certificate...
CVE-2011-3634
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors...
CVE-2011-3634
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors...
Apple Ships Critical OS X 10.9.2 Security Update
Apple today shipped a security update resolving a critical certificate-validation vulnerability in its OS X Mavericks operating system. Details of the bug, which exists in OS X version 10.9.1 and is resolved by version 10.9.2, emerged on Friday after the company patched essentially the same bug i...
Internet Bug Bounty: Widespread failure of certificate validation in Android apps
I have identified approximately 75 Android applications and some iPad that fail to validate SSL certificates, either failing to validate valid certificate authorities, correct hostnames or both. I have made attempts to responsibly disclose all of these vulns to the responsible parties. A few have...
Mac OS X 10.9.x < 10.9.2 Multiple Vulnerabilities
The remote host is running a version of Mac OS X 10.9.x that is prior to 10.9.2. This update contains several security-related fixes for the following components : - Apache - ATS - Certificate Trust Policy - CoreAnimation - CoreText - curl - Data Security - Date and Time - File Bookmark - Finder ...
