The vulnerability in the implementation of the OCSP_basic_verify() function in the OpenSSL library allows a perpetrator to carry out a type of “man-in-the-middle” attack.

The vulnerability in the implementation of the OCSPbasicverify function in the OpenSSL library is related to errors in the certificate validation process when the OCSPNOCHECKS flag is used. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...

Mobaoku-Auction&Flea Market 信任管理问题漏洞

Mobaoku-Auction&Flea Market is a mobile software. Mobaoku-Auction&Flea Market is vulnerable to a trust management issue, which arises from improper server certificate validation. A remote attacker could exploit the vulnerability to eavesdrop on encrypted communications...

CVE-2022-29082

Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port 5671 which could allow remote...

CVE-2022-29082

Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port 5671 which could allow remote...

Input validation

Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port 5671 which could allow remote...

CVE-2022-29082

Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port 5671 which could allow remote...

GHSA-W45J-F832-HXVH Pion/DLTS Accepts Client Certificates Without CertificateVerify

Impact A DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a...

GHSA-RGHW-6PX2-FGWC Improper Certificate Validation in MongoDB

Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...

GHSA-8MX3-GP3P-VGG7 kevinsawicki/http-request Missing certificate validation

OSS Http Request kevinsawicki/http-request is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing...

kevinsawicki/http-request Missing certificate validation

OSS Http Request kevinsawicki/http-request is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing...

Improper Certificate Validation

Overview std/crypto/x509 is a Go standard library package std/crypto/x509 Affected versions of this package are vulnerable to Improper Certificate Validation. Go Vulnerability Report: On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate...

GHSA-6CWM-WM82-HGRW MongoDB Tools Improper Certificate Validation vulnerability

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...

GHSA-Q296-9J5X-FXF4 SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin

Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers. Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by...

SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin

Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers. Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by...

GHSA-W589-R335-4F55 SaltStack Salt Improper Certificate Validation

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...

Improper Certificate Validation

Overview com.squareup.okhttp3:okhttp is a HTTP & HTTP/2 client for Android and Java applications Affected versions of this package are vulnerable to Improper Certificate Validation via the verifyHostName function in OkHostnameVerifier.java. An attacker can gain unauthorized access to sensitive...

GHSA-6FR3-286Q-Q3CR Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin

Jenkins Mailer Plugin prior to 1.32.1, 1.31.1, and 1.29.1 does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections. Mailer Plugin 1.32.1, 1.31.1, and 1.29.1 validates...

Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin

Jenkins Mailer Plugin prior to 1.32.1, 1.31.1, and 1.29.1 does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections. Mailer Plugin 1.32.1, 1.31.1, and 1.29.1 validates...

GHSA-W6XV-MF6F-R5F6 Scalyr Agent Missing SSL Certificate Validation

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verifyhostname option...

GHSA-M462-MQW4-2C8M Mattermost Server has X.509 Improper Certificate Validation

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server...