CVE-2021-1837

A certificate validation issue was addressed. This issue is fixed in iOS 14.5 and iPadOS 14.5. An attacker in a privileged network position may be able to alter network traffic...

CVE-2021-1837

A certificate validation issue was addressed. This issue is fixed in iOS 14.5 and iPadOS 14.5. An attacker in a privileged network position may be able to alter network traffic...

CVE-2021-1837

The CVE-2021-1837 entry corresponds to a certificate validation issue fixed in iOS 14.5 / iPadOS 14.5. Affected products are Apple iOS/iPadOS; vulnerability arises from improper certificate validation, enabling an attacker in a privileged network position to alter network traffic. Mitigation/repa...

CVE-2021-27018

The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source...

CVE-2021-27018

The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source...

Design/Logic Flaw

The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source...

UBUNTU-CVE-2021-27018

The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source...

CVE-2021-27018

CVE-2021-27018 is a certificate validation flaw where the mechanism validating certificates fails to properly validate certificates signed by an internal CA. Documented impact is that affected clients configured to use Tenable.sc as the vulnerability data source may be unable to validate such cer...

GHSA-34P9-F4Q3-C4R7 Improper Certificate Validation in openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter no error was returned and connections to servers with an expired certificate would have been accepted.

...

ARM mbed TLS Trust Management Issue Vulnerability

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption for mbed products. ARM mbed TLS has a security vulnerability that stems from the fact that the null algorithm parameter term is the same as the real array of size 0 and therefore the certificate is considered...

Insecure Certificate Validation

Nextcloud Desktop Client is using an insecure certificate validation. It is possible due to lack of SSL certificate verification when using the "Register with a Provider" flow...

Code injection

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. A NULL algorithm parameters entry looks identical to an array of REAL size zero and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate...

UBUNTU-CVE-2020-36478

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. A NULL algorithm parameters entry looks identical to an array of REAL size zero and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate...

CVE-2020-36478

CVE-2020-36478 affects Mbed TLS up to versions preceding 2.25.0 (and the LTS lines 2.16.9 and 2.7.18). The issue: a NULL algorithm parameters entry can look identical to an empty REAL array, causing a certificate to be treated as valid even when parameters do not match. If parameters do not match...

CVE-2020-36478

An issue was discovered in Mbed TLS before 2.25.0 and before 2.16.9 LTS and before 2.7.18 LTS. A NULL algorithm parameters entry looks identical to an array of REAL size zero and thus the certificate is considered valid. However, if the parameters do not match in any way, then the certificate...

Gitlab Grilo信任管理问题漏洞

Gitlab Grilo is a framework for browsing and searching media content from a variety of sources using a single API. A security vulnerability exists in GNOME grilo 0.3.13 and earlier versions, which stems from the program grl-net-wc.c not enabling TLS certificate validation on the SoupSessionAsync...

evolution-rss 信任管理问题漏洞

evolution-rss is This is an evolution plugin that enables evolution to read RSS feeds. A security vulnerability exists in GNOME evolution-rss 0.3.96 and earlier versions, which stems from the fact that network-soup.c in the program does not enable TLS certificate validation for the SoupSessionSyn...

GNOME libgfbgraph 信任管理问题漏洞

libgfbgraph is the GObject library for the Facebook Graph API. A security vulnerability exists in GNOME libgfbgraph, which stems from the fact that in GNOME libgfbgraph version 0.2.4, gfbgraph-photo.c does not enable TLS certificate validation on the SoupSessionSync object it creates. An attacker...

GNOME libzapojit 信任管理问题漏洞

libzapojit is a GLib/GObject wrapper for the SkyDrive and Hotmail REST APIs. A security vulnerability exists in GNOME libzapojit, which stems from the fact that in version 0.0.3 of GNOME libzapojit, zpj-skydrive.c does not enable TLS certificate validation on the SoupSessionSync object it creates...