8146 matches found
CVE-2020-3994
VMware vCenter Server 6.7 before 6.7u3, 6.6 before 6.5u3k contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repositor...
CVE-2020-3994
VMware vCenter Server 6.7 before 6.7u3, 6.6 before 6.5u3k contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repositor...
Session fixation
VMware vCenter Server 6.7 before 6.7u3, 6.6 before 6.5u3k contains a session hijack vulnerability in the vCenter Server Appliance Management Interface update function due to a lack of certificate validation. A malicious actor with network positioning between vCenter Server and an update repositor...
CVE-2020-3994
CVE-2020-3994 affects VMware vCenter Server (versions 6.7 before 6.7u3, 6.6 before 6.5u3k). It is a session hijack vulnerability in the vCenter Server Appliance Management Interface (VAMI) update function caused by a lack of certificate validation. An attacker with network position between vCente...
PT-2021-13852 · Stunnel +9 · Stunnel +9
Name of the Vulnerable Software and Affected Versions: stunnel versions prior to 5.57 Description: A flaw was found in stunnel where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate sign...
GHSA-55W9-C3G2-4RRH Man-in-the-middle attack in Apache Axis
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...
CVE-2020-15589
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...
CVE-2020-15589
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...
Remote code execution
A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate in the client side of Zoho ManageEngine Desktop Central 10.0.552.W and Remote Access Plus before 10.1.2119.1. By exploiting this issue, an attacker-controlled server can force the...
CVE-2020-15589
The CVE-2020-15589 entry affects Zoho ManageEngine Desktop Central (client side) 10.0.552.W and Remote Access Plus prior to 10.1.2119.1. A design issue in GetInternetRequestHandle, InternetSendRequestEx and InternetSendRequestByBitrate can be abused by an attacker-controlled server to force the c...
The vulnerability of the Apache NetBeans application environment update system, related to errors in the certificate validation process, allows attackers to compromise the confidentiality and integrity of the protected information.
The vulnerability of the Apache NetBeans application environment update system is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...
EulerOS Virtualization for ARM 64 3.0.6.0 : openldap (EulerOS-SA-2020-2023)
According to the version of the openldap packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is...
Huawei EulerOS: Security Advisory for openldap (EulerOS-SA-2020-2023)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.
...
IBM Security Secret Server Security Bypass Vulnerability
IBM Security Secret Server is a set of privileged access management solutions from IBM USA. The product supports password management, privileged account identification and privileged session access monitoring and logging. A security vulnerability exists in IBM Security Secret Server prior to...
Vulnerabilities fixed in Trend Micro products
Trend Micro has fixed vulnerabilities in several products. The vulnerabilities allow a remote malicious person to able to install a rogue update. This is made possible by an SSL server-certification-validation vulnerability combined with another vulnerability. Trend Micro makes little information...
CVE-2020-4340
IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180...
CVE-2020-4340
IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180...
