UBUNTU-CVE-2020-28972

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...

UBUNTU-CVE-2020-35662

In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated...

PYSEC-2021-74

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...

PYSEC-2021-75

In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated...

CVE-2020-35662

SaltStack Salt before 3002.5 does not consistently validate SSL certificates during authentication with certain modules. Affected: Salt (SaltStack Salt) core; root cause: SSL certificate validation is bypassed/not consistently enforced. Impact: potential exposure of credentials or sensitive data ...

Man-in-the-Middle (MitM)

mongodb-client-encryption is vulnerable to man-in-the-middle attacks. The module does not perform correct validation of the KMS servers certificate and would potentially allow for man-in-the-middle attackers to intercept and modify network traffic...

Saltstack SaltStack Salt 信任管理问题漏洞

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions prior to Salt 3002.5, which stems from the fact that...

Saltstack SaltStack Salt 信任管理问题漏洞

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions prior to Salt 3002.5 that stems from the failure to alway...

Netgear NETGEAR R7800 信任管理问题漏洞

The Netgear NETGEAR R7800 is a wireless router from the American company Netgear. The NETGEAR R7800 suffers from a remote code execution vulnerability that stems from a failure to properly validate server-supplied certificates, which can be exploited by an attacker to execute arbitrary code in...

(Pwn2Own) NETGEAR R7800 ready-genie-cloud Improper Certificate Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via FTP. The issue results...

CVE-2021-20327

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...

Design/Logic Flaw

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...

CVE-2021-20327

CVE-2021-20327 affects the Node.js mongodb-client-encryption library, specifically version 1.2.0, which does not perform proper validation of the KMS server certificate. This can enable an attacker with privileged network access to perform a MITM and intercept traffic between the Node.js driver a...

CVE-2021-20327

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...

MongoDB Trust Management Issues Vulnerabilities

MongoDB is a document-oriented database management system from the U.S.-based MongoDB, Inc. MongoDB is vulnerable to a trust management issue that stems from not performing proper KMS server certificate validation...

ELECOM WRC-300FEBK-S Certificate Validation Error Vulnerability

The ELECOM WRC-300FEBK-S is a network camera for the home from Elecom Japan. A certificate validation error vulnerability exists in the ELECOM WRC-300FEBK-S, which can be exploited by an attacker to alter the communication response and execute arbitrary commands on the product...

AZL-7375 CVE-2021-20230 affecting package stunnel for versions less than 5.70-1

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to...

CVE-2021-20230

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to...

UBUNTU-CVE-2021-20230

A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to...

CVE-2021-20230

CVE-2021-20230 affects stunnel before 5.57. When configured to use both redirect and verifyChain, it improperly validates client certificates, allowing a certificate signed by a different CA to access the tunneled service instead of redirecting. The highest impact is on confidentiality. Several a...