Improper Certificate Validation

cn.hutool:hutool-http is vulnerable to Improper certificate validation. The vulnerability exists due to the insufficient validations of TLS/SSL certificates in verify function in TrustAnyHostnameVerifierof class...

GHSA-P7W9-8MXW-P3G7 Improper Certificate Validation in Hutool

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Improper Certificate Validation in Hutool

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Improper Certificate Validation

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket

Impact If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults. When looking up a WSS endpoint using the DNS TXT record method described in XEP-0156: Discovering Alternative XMPP Connection Methods the ServerName field...

CVE-2022-22885

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Design/Logic Flaw

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

CVE-2022-22885

CVE-2022-22885 affects Hutool v5.7.18: Hutool.HttpRequest incorrectly ignores TLS/SSL certificate validation, creating a trust-management vulnerability that enables network-based MITM attacks. CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with base score 9.8; CVSS2.0 also 7.5. Exploitation details ...

CVE-2022-22885

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation...

Improper Validation of Certificate with Host Mismatch in mellium.im/xmpp/websocket

If no TLS configuration is provided by the user, the websocket package constructs its own TLS configuration using recommended defaults...

PT-2022-15716 · Hutool · Hutool

Name of the Vulnerable Software and Affected Versions: Hutool version 5.7.18 Description: The issue concerns the ignoring of all TLS/SSL certificate validation in Hutool's HttpRequest. Recommendations: For Hutool version 5.7.18, update to a version that properly validates TLS/SSL certificates to...

Hutool 安全漏洞

Hutool is a small but comprehensive Java tools library from the Chinese Dromara community. Hutool suffers from a trust management issue vulnerability that stems from Hutool v5.7.18's HttpRequest was found to ignore all TLS/SSL certificate validations...

Vulnerability of the Node.js software platform’s Relative Distinguished Name (RDN) component, which allows attackers to perform spoofing attacks

The vulnerability of the Relative Distinguished Name RDN component in the Node.js software platform is related to errors in the certificate validation process. Exploiting this vulnerability allows attackers to perform spear-phishing attacks remotely...

The vulnerability of the implementation of the method for specifying all domain names and IP addresses in the Node.js software platform allows attackers to perform spoofing attacks.

The vulnerability of the method for specifying all domain names and IP addresses on the Node.js software platform is related to errors in the X.509 certificate validation process. Exploiting this vulnerability allows a malicious actor to perform spoofing attacks remotely...

The vulnerability of the implementation for specifying all domain names and IP addresses using Subject Alternative Names in the Node.js software platform allows attackers to perform spoofing attacks.

The vulnerability of the method for specifying all domain names and IP addresses in a Node.js software platform is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to perform spoofing attacks remotely...

SUSE SLES15 Security Update : busybox (SUSE-SU-2022:0135-2)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0135-2 advisory. - CVE-2011-5325: Fixed tar directory traversal bsc951562. - CVE-2015-9261: Fixed segfalts and application crashes in huftbuild bsc1102912. -...

GHSA-M658-P24X-P74R Duplicate Advisory: TLS certificate validation error in mellium.im/xmpp

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-h289-x5wc-xcv8. This link is maintained to preserve external references. Original Description In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket...

Mellium 安全漏洞

Mellium is a feature that provides functionality from the Extensible Messaging and Presence Protocol. Mellium suffers from a security vulnerability that could be exploited by an attacker to redirect WebSocket connection requests to a server under their control without causing TLS certificate...

PT-2022-17018 · Mellium · Mellium

Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/xmpp versions 0.21.0 and earlier Description: An attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail...

Improper Certificate Validation in Graylog

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...