CVE-2020-14981

The ThreatTrack VIPRE Password Vault app through 1.100.1090 for iOS has Missing SSL Certificate Validation...

PT-2020-14104 · Sophos · Sophos Secure Email

Name of the Vulnerable Software and Affected Versions: Sophos Secure Email versions through 3.9.4 for Android Description: The issue is related to missing SSL certificate validation. This could potentially allow for man-in-the-middle attacks, where an attacker intercepts and alters communication...

Mattermost Server Trust Management Issues Vulnerability (CNVD-2020-35449)

Mattermost Server is the United States Mattermost company's set of open source messaging platform. A security vulnerability exists in Mattermost Server versions prior to 3.8.2, prior to 3.7.5, and prior to 3.6.7. An attacker could exploit the vulnerability to bypass X.509 certificate validation f...

PT-2020-14105 · Threattrack · Vipre Password Vault

Name of the Vulnerable Software and Affected Versions: ThreatTrack VIPRE Password Vault app versions through 1.100.1090 for iOS Description: The issue is related to missing SSL certificate validation. Recommendations: For ThreatTrack VIPRE Password Vault app versions through 1.100.1090, update to...

CVE-2017-18911

An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server...

PT-2020-8457

Name of the Vulnerable Software and Affected Versions: Mattermost Server versions prior to 3.8.2 Mattermost Server versions prior to 3.7.5 Mattermost Server versions prior to 3.6.7 Description: An issue was discovered that allows the X.509 certificate validation to be skipped for a TLS-based e-ma...

Palo Alto GlobalProtect Agent 5.0.x < 5.0.10 / 5.1.x < 5.1.4 Missing Certificate Validation

The version of Palo Alto GlobalProtect Agent installed on the remote host is 5.0.x prior to 5.0.10, or 5.1.x prior to 5.1.4. It is, therefore, affected by a missing certificate validation vulnerability. When the pre-logon feature is enabled, a missing certification validation in Palo Alto Network...

CVE-2020-5367

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an improper certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this...

log4j: improper validation of certificate with host mismatch in SMTP appender

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

Fedora 31 : gnutls (2020-76b705bb63)

Update to upstream 3.6.14 release, and security fix for CVE-2020-13777. ---- - Fix certificate chain validation involving the expired 'AddTrust External Root'. - Disable RSA blinding during FIPS self-tests to avoid hanging if there is not enough entropy for getrandom - Add --waitresumption option...

(0Day) (Pwn2Own) NETGEAR R6700 check_ra Improper Certificate Validation Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issu...

CVE-2019-16252

Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests, including login credentials and location data...

Design/Logic Flaw

Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests, including login credentials and location data...

CVE-2019-16252

The CVE-2019-16252 entry concerns the Nutfind.com Android app (up to version 3.9.12) with missing SSL certificate validation, enabling a man-in-the-middle to sniff and manipulate API requests, including login credentials and location data. Root cause is improper SSL certificate validation in the ...

CVE-2019-16252

Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests, including login credentials and location data...

CVE-2020-0119

In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for...

CVE-2020-0119

In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for...

CVE-2020-2033 GlobalProtect App: Missing certificate validation vulnerability can disclose pre-logon authentication cookie

When the pre-logon feature is enabled, a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or to conduct ARP spoofing...

CVE-2020-0119

In addOrUpdateNetworkInternal and related functions of WifiConfigManager.java, there is a possible man in the middle attack due to improper certificate validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for...

CVE-2020-0119

CVE-2020-0119 affects Android 10 and is caused by improper certificate validation in WifiConfigManager.java (addOrUpdateNetworkInternal and related functions), enabling a possible man-in-the-middle attack that could lead to remote information disclosure. Exploitation requires user interaction, an...