Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N — Medium 6.8 A vulnerability exists in the Kubernetes C client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority CA without properly verifying the trust chain. This flaw allows ...

Erlang/OTP (Erlang OTP) TLS Occasional Improper ROOT Certificate Validation Vulnerability (GHSA-3rgm-p3c6-g54m) - Windows

Erlang/OTP Erlang OTP is prone to a TLS occasional improper ROOT certificate validation vulnerability in the ssl component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Erlang/OTP (Erlang OTP) TLS Occasional Improper ROOT Certificate Validation Vulnerability (GHSA-3rgm-p3c6-g54m) - Linux

Erlang/OTP Erlang OTP is prone to a TLS occasional improper ROOT certificate validation vulnerability in the ssl component. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

PT-2025-38069

Name of the Vulnerable Software and Affected Versions Kubernetes C client versions prior to 17.0.14 Description A flaw exists in the Kubernetes C client's certificate validation logic, allowing it to accept certificates from any Certificate Authority CA without proper trust chain verification. Th...

CVE-2025-58781

WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic...

The vulnerability of the GnuTLS transport layer security library, related to errors in the certificate validation process, allows attackers to gain unauthorized access to confidential information.

The vulnerability of the Transport Layer Security library GnuTLS is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to confidential information...

CVE-2025-58781

WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic...

CVE-2025-58781

WTW-EAGLE App does not properly validate server certificates, which may allow a man-in-the-middle attacker to monitor encrypted traffic...

CVE-2025-58781

Vulnerability : CVE-2025-58781 affects the WTW-EAGLE App. The app does not properly validate server certificates, enabling a man-in-the-middle attacker to monitor encrypted traffic. Affected products/versions : WTW-EAGLE App for iOS prior to 4.4.1 and Android prior to 4.4.0.10. Other sources reit...

WTW-EAGLE App vulnerable to improper server certificate validation

Overview WTW-EAGLE App provided by Wireless Tsukamoto Co., Ltd. contains the following vulnerability. Improper server certificate validation CWE-295 - CVE-2025-58781 Shogo Iyota of GMO Cybersecurity by Ierae reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

WTW-EAGLE App 信任管理问题漏洞

WTW-EAGLE App is a mobile application from WTW that has the ability to provide risk management, insurance data access and analytics. A trust management issue vulnerability exists in the WTW-EAGLE App that stems from not properly validating server certificates, which could lead to a...

JVN#89109713: WTW-EAGLE App vulnerable to improper server certificate validation

WTW-EAGLE App provided by Wireless Tsukamoto Co., Ltd. contains the following vulnerability. Improper server certificate validation CWE-295 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 6.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Base Score 4.8 CVE-2025-58781...

PT-2025-37292

Name of the Vulnerable Software and Affected Versions: WTW-EAGLE App affected versions not specified Description: The WTW-EAGLE App does not properly validate server certificates, potentially allowing a man-in-the-middle attacker to monitor encrypted traffic. Recommendations: At the moment, there...

Advisory ROSA-SA-2025-2997

software: curl 8.7.1 OS: ROSA-CHROME unaffected versions = curl-8.7.1-4 affected versions curl-8.7.1-4 CVE-ID: CVE-2024-11053 BDU-ID: 2024-11106 CVE-Crit: CRITICAL CVE-DESC.: A vulnerability in the netrc file handler of the cURL command line utility is related to insufficient protection of servic...

Exploit for CVE-2025-46408

CVE-2025-46408 Improper Hostname Verification in EagleEyes...

Linux Distros Unpatched Vulnerability : CVE-2023-5422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresu...

Linux Distros Unpatched Vulnerability : CVE-2016-4763

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers...

Linux Distros Unpatched Vulnerability : CVE-2019-1010275

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed...

Linux Distros Unpatched Vulnerability : CVE-2013-6662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Google Chrome caches TLS sessions before certificate validation occurs. CVE-2013-6662 Note that Nessus relies on the presence of the package as reported by the...

Linux Distros Unpatched Vulnerability : CVE-2020-7956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to...