WolfSSL CyaSSL Certificate Validation Bypass Vulnerability

WolfSSL CyaSSL is the United States WolfSSL company for embedded systems developers to use a small, portable embedded SSL programming library. A certificate validation bypass vulnerability exists in WolfSSL CyaSSL. A remote attacker can exploit this vulnerability to spoof a server with a speciall...

Cisco IOS Software Plug-and-Play PKI API Certificate Validation Vulnerability

According to its self-reported version, the IOS is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...

CVE-2017-14582

Zoho Site24x7 Mobile Network Poller for Android (before 1.1.5) does not verify SSL X.509 certificates, enabling MITM via self-signed certs. Affected component: Android client; root cause: absent certificate verification. Impact: potential disclosure of sensitive information; exploitation details ...

CVE-2017-12228

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient...

Design/Logic Flaw

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient...

CVE-2017-12228

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS 12.4 through 15.6 and Cisco IOS XE 3.3 through 16.4 could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient...

CVE-2017-12228

CVE-2017-12228 affects Cisco Network Plug and Play in Cisco IOS 12.4–15.6 and Cisco IOS XE 3.3–16.4. The root cause is insufficient certificate validation in the PKI API, allowing an unauthenticated remote attacker to supply a crafted certificate and perform MITM to decrypt user data. Exploitatio...

The vulnerability of Kaspersky Safe Browser’s antivirus protection lies in the lack of protection for service data, which allows attackers to obtain confidential information.

The vulnerability of Kaspersky Safe Browser lies in the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain confidential information using a specially crafted certificate. The problem is that Kaspersky Safe Browser does not...

Cisco IOS and IOS XE Software Plug-and-Play PKI API Certificate Validation Vulnerability

A vulnerability in the Cisco Network Plug and Play application of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate...

Mobile Stock Trading App Providers Unresponsive to Glaring Vulnerabilities

More than 20 of the most popular mobile trading applications used by consumers and day-traders for securities transactions contain glaring vulnerabilities that could allow attackers to sniff personal data or steal money from accounts. Researchers from IOActive today published a report describing...

Apple Mac OS X Multiple Vulnerabilities (HT208144)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Code injection

The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS ap...

CVE-2016-10511

The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS ap...

CVE-2016-10511

The CVE-2016-10511 entry affects Twitter iOS client versions 6.62 and 6.62.1, which fail to validate Twitter’s server certificates for the /1.1/help/settings.json endpoint. This allows man-in-the-middle attackers to view an application-only OAuth client token and potentially enable unreleased Twi...

GLSA-201709-04 : mod_gnutls: Certificate validation error

The remote host is affected by the vulnerability described in GLSA-201709-04 modgnutls: Certificate validation error It was discovered that the authentication hook in modgnutls does not validate clients certificates even when option GnuTLSClientVerify is set to require. Impact : A remote attacker...

mod_gnutls: Certificate validation error

Background modgnutls is an extension for ​Apache’s httpd. It uses the ​GnuTLS library to provide HTTPS. It supports some protocols and features that modssl does not. Description It was discovered that the authentication hook in modgnutls does not validate client’s certificates even when option...

D-Link DIR-850L REV.A and REV.B Man-in-the-Middle Attack Vulnerability

The D-Link DIR-850L REV.A and REV.B are both wireless router products from AUO D-Link. The security vulnerability in the D-Link NPAPI extension used in D-Link DIR-850L REV.A devices with firmware FW114WWb07h2abbeta1 and earlier and REV.B devices with firmware FW208WWb02 and earlier stems from the...

D-Link DIR-850L Information Disclosure Vulnerability

The D-Link DIR-850L is a wireless router from AUO D-Link. A security vulnerability exists in the NPAPI extension in the D-Link DIR-850L using FW114WWb07h2abbeta1 and earlier versions, which stems from the program failing to properly validate certificates. A remote attacker could exploit the...

EulerOS 2.0 SP2 : pidgin (EulerOS-SA-2017-1166)

According to the versions of the pidgin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A denial of service flaw was found in the way Pidgin's Mxit plug-in handled emoticons. A malicious remote server or a man-in-the-middle attacker...

McAfee LiveSafe 16.0.3 - Man In The Middle Registry Modification Leading to Remote Command Execution

Vulnerabilities Summary The following advisory describes a Remote Command Execution found in McAfee McAfee LiveSafe MLS versions prior to 16.0.3. The vulnerability allows network attackers to modify the Windows registry value associated with the McAfee update via the HTTP backend-response. McAfee...