CVE-2020-11176

CVE-2020-11176 is a memory-corruption issue in Qualcomm closed‑source components (cert processing for IPSec server certificates; SAN API) that can cause a heap overflow. Affected: Snapdragon/mobile Qualcomm stack as per the CVE entry and Qualcomm bulletin; CVSSv3.1 base score 9.8 (Crypto/Network ...

CVE-2021-20732

CVE-2021-20732 concerns the ATOM - Smart life App (Android v1. unaffected; affected are Android versions prior to 1.8.1 and iOS prior to 1.8.2) lacking proper server certificate verification (CWE-295). The issue enables a man-in-the-middle attacker to eavesdrop on encrypted traffic through a craf...

SUSE: Security Advisory (SUSE-SU-2014:0580-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2019:0139-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the cryptographic functions of the GoLang development library used by Aurora Application Software Center is related to errors in the authentication process for certificates. This error allows a perpetrator to cause service failures.

The vulnerability of the cryptographic functions of the GoLang development library used by Aurora Application Software Center is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker, operating remotely, to cause service failures...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Node.js

Summary IBM has addressed the applicable CVEs Vulnerability Details CVEID: CVE-2019-15606 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions, caused by an issue when HTTP header values do not have trailing OWS trimmed. By sending a specially-crafted request, an...

CVE-2021-21559

Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client NetWorker Management Console components which uses SSL encrypted connection in order to communicate with the application server. An unauthenticated...

CVE-2021-21559

Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client NetWorker Management Console components which uses SSL encrypted connection in order to communicate with the application server. An unauthenticated...

Input validation

Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client NetWorker Management Console components which uses SSL encrypted connection in order to communicate with the application server. An unauthenticated...

CVE-2021-21559

Dell EMC NetWorker, versions 18.x, 19.1.x, 19.2.x 19.3.x, 19.4, and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client NetWorker Management Console components which uses SSL encrypted connection in order to communicate with the application server. An unauthenticated...

CVE-2021-21559

Dell EMC NetWorker (versions 18.x, 19.1.x, 19.2.x, 19.3.x, 19.4, 19.4.0.1) has an Improper Certificate Validation vulnerability in the NetWorker Management Console client that can allow an unauthenticated attacker on the same network to perform man-in-the-middle attacks and intercept/tamper SSL t...

Siemens SIMATIC TIM libcurl

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC TIM libcurl Vulnerabilities: Exposure of Sensitive Information to an Unauthorized Actor, Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of these...

Hardcoded credentials

WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the...

CVE-2021-29504 Improper Certificate Validation in WP-CLI framework

WP-CLI is the command-line interface for WordPress. An improper error handling in HTTPS requests management in WP-CLI version 0.12.0 and later allows remote attackers able to intercept the communication to remotely disable the certificate verification on WP-CLI side, gaining full control over the...

Qualcomm 组件缓冲区错误漏洞

The Qualcomm Component is a component of Qualcomm Incorporated USA. The intrinsic parts that provide the functionality of Qualcomm devices. A buffer error vulnerability exists in the Qualcomm component that stems from the fact that when processing server certificates from an IPSec server,...

Security Bulletin: IBM WebSphere Application Server Hypervisor GnuTLS certificate security bypass CVE-2014-0092

Summary GnuTLS in Red Hat Enterprise Linux that ships with IBM WebSphere Application Server Hypervisor edition could allow a remote attacker to bypass security restrictions, caused by an error when verifying unspecified certificates. By persuading a victim to visit a specially-crafted Web site, a...

ATOM-Smart life App 信任管理问题漏洞

ATOM tech ATOM-Smart life App is a smart life application from ATOM tech, Japan. ATOM-Smart life App 1.8.0 suffers from a trust management issue vulnerability that originates from improper server certificate validation. A remote attacker can exploit this vulnerability to conduct a MitM attack on...

AZL-7462 CVE-2020-14387 affecting package rsync for versions less than 3.2.3-2

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise...

CVE-2020-14387

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise...

ALPINE-CVE-2020-14387

A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise...