CVE-2012-1316

CVE-2012-1316 affects the Cisco IronPort Web Security Appliance, where the product does not check for certificate revocation, potentially enabling MITM attacks. The linked sources show an impact on integrity (CVSS3.1: HIGH) with network exposure (CVSS3.1: AV:N, AC:H, PR:N, UI:N, S:U) and a CVSSv2...

PT-2020-7184

Name of the Vulnerable Software and Affected Versions Cisco IronPort Web Security Appliance affected versions not specified Description The issue is related to the Cisco IronPort Web Security Appliance not checking for certificate revocation, which could lead to man-in-the-middle MITM attacks...

CVE-2012-1316: Improper Certificate Validation

Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks...

CVE-2019-15006

There was a man-in-the-middle MITM vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence...

Information disclosure

There was a man-in-the-middle MITM vulnerability present in the Confluence Previews plugin in Confluence Server and Confluence Data Center. This plugin was used to facilitate communication with the Atlassian Companion application. The Confluence Previews plugin in Confluence Server and Confluence...

Puppet Agent Trust Management Issue Vulnerability

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Agent is a Puppet agent end program. A security vulnerability exists in...

DEBIAN-CVE-2019-19271

An issue was discovered in tlsverifycrl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries installed by a system administrator, can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to...

DEBIAN-CVE-2019-19270

An issue was discovered in tlsverifycrl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry checking twice for subject, rather than once for subject and once for issuer prevents some valid CRLs from being taken into account, and can allow clients whose certificate...

CVE-2019-19271

An issue was discovered in tlsverifycrl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries installed by a system administrator, can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to...

UBUNTU-CVE-2019-19271

An issue was discovered in tlsverifycrl in ProFTPD before 1.3.6. A wrong iteration variable, used when checking a client certificate against CRL entries installed by a system administrator, can cause some CRL entries to be ignored, and can allow clients whose certificates have been revoked to...

Code injection

An issue was discovered in tlsverifycrl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry checking twice for subject, rather than once for subject and once for issuer prevents some valid CRLs from being taken into account, and can allow clients whose certificate...

UBUNTU-CVE-2019-19270

An issue was discovered in tlsverifycrl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry checking twice for subject, rather than once for subject and once for issuer prevents some valid CRLs from being taken into account, and can allow clients whose certificate...

CVE-2019-19270

An issue was discovered in tlsverifycrl in ProFTPD through 1.3.6b. Failure to check for the appropriate field of a CRL entry checking twice for subject, rather than once for subject and once for issuer prevents some valid CRLs from being taken into account, and can allow clients whose certificate...

CVE-2019-19270

ProFTPD TLS CRL check flaw: tls_verify_crl in ProFTPD up to 1.3.6b does not properly verify CRL entry fields, potentially allowing revoked certificates to connect. OpenSUSE/Fedora advisories fix CVE-2019-19270 by updating ProFTPD to 1.3.6b (and later) and related patches in 1.3.6/1.3.6a/b. Applie...

CVE-2019-19271

CVE-2019-19271 affects ProFTPD, where the tls_verify_crl check in versions before 1.3.6 uses a wrong iteration variable when comparing a client certificate against CRL entries. This can cause certain CRL entries to be ignored, potentially allowing clients with revoked certificates to establish a ...

PT-2019-15797

Name of the Vulnerable Software and Affected Versions ProFTPD versions through 1.3.6b Description An issue was discovered in the tls verify crl function. A dereference of a NULL pointer may occur when the OpenSSL sk X509 REVOKED value function encounters an empty CRL installed by a system...

PT-2019-15798

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.7 Description An issue was discovered in the tls verify crl function, which prevents some valid Certificate Revocation Lists CRLs from being taken into account. This can allow clients whose certificates have been...

Cisco IOS XE Software Autonomic Networking Infrastructure Certificate Revocation (cisco-sa-20170726-anicrl)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the Autonomic Networking feature because the affected software does not transfer certificate revocation lists CRLs across Autonomic Control Plane ACP channels. An unauthenticated, remote attacker can...

The vulnerability of the FortiOS operating system, the FortiAnalyzer network firewall, and the FortiManager centralized management system lies in the lack of mechanisms for checking certificate revocation. This allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of the FortiOS operating system, FortiAnalyzer network firewall, and FortiManager centralized management system are related to the lack of verification for certificate revocation. Exploiting these vulnerabilities allows a malicious actor to compromise the confidentiality,...

PT-2019-20328

Уязвимость операционной системы FortiOS, межсетевого экрана FortiAnalyzer и системы централизованного управления FortiManager связана с отсутствием проверки отзыва сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на конфиденциальность,...