MEA Financial Vision Bank Information Disclosure Vulnerability

Vision Bank offers you the convenience of enjoying online banking services through your cell phone. MEA Financial vision-bank/id420406345 app 3.0.1 for iOS fails to validate SSL servers with X.509 certificates, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information...

CVE-2017-9599

The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2017-9594

The "SVB Mobile" by Sauk Valley Bank Mobile Banking app 3.0.0 -- aka svb-mobile/id796429885 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9575

The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9580

The "Pioneer Bank & Trust Mobile Banking" by PIONEER BANK AND TRUST app 3.0.0 -- aka pioneer-bank-trust-mobile-banking/id603182861 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2017-9599

The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2016-5648

Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate...

CVE-2016-5648

The Acer Portal Android app (versions 3.9.3.2003–3.9.3.2006) is affected by CVE-2016-5648 due to improper SSL certificate validation, allowing remote MITM attacks and potential credential exposure when connecting to Acer Cloud. Impact is a credential/theory exposure via unauthenticated, network-b...

DEBIAN-CVE-2017-9022

The gmp plugin in strongSwan before 5.5.3 does not properly validate RSA public keys before calling mpzpowmsec, which allows remote peers to cause a denial of service floating point exception and process crash via a crafted certificate...

About the security content of macOS Sierra 10.12.5, Security Update 2017-002 El Capitan, and Security Update 2017-002 Yosemite - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. For more information about security, se...

NXP i.MX Product Family

CVSS v3 6.0 REPOSTED INFORMATION This advisory was originally posted to the NCCIC Portal on June 1, 2017, and is being released to the NCCIC/ICS-CERT web site. AFFECTED PRODUCTS The following i.MX Devices, used on logic boards, are affected: Devices affected by the Stack Buffer Overflow...

Scientific Linux Security Update : nss on SL6.x i386/x86_64 (20170530)

Security Fixes : - A NULL pointer dereference flaw was found in the way NSS handled empty SSLv2 messages. An attacker could use this flaw to crash a server application compiled against the NSS library. CVE-2017-7502 Bug Fixes : - The Network Security Services NSS code and Certificate Authority CA...

Design/Logic Flaw

Apache Hive JDBC + HiveServer2 implements SSL for plain TCP and HTTP connections it supports both transport modes. While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name...

CVE-2016-3083

CVE-2016-3083 affects Apache Hive JDBC/HiveServer2: SSL is used for plain TCP and HTTP, but the client may fail to verify the certificate’s common name during the SSL handshake in Hive versions before 1.2.2 and 2.0.x before 2.0.1. This can allow a server presenting a valid CA-signed cert for a di...

Certificate Validation Bypass Due To SSL Vulnerability

hive-service is susceptible to certificate validation bypass. The client bypasses the validation of the common name attribute in the certificate of the server after sending an SSL request to it. Therefore, the client regards the certificate as a valid certificate and proceeds to the SSL handshake...

UBUNTU-CVE-2017-2800

A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply ...

CVE-2017-2800

A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution. In order to trigger this vulnerability, the attacker needs to supply ...

hammer_cli SSL Certificate Authentication Security Bypass Vulnerability

Hammer is a general-purpose clamp-based CLI framework from Foreman. hammer-cli provides only the core functionality. A SSL certificate authentication security bypass vulnerability exists in hammercli, which stems from the program failing to properly validate SSL certificates. An attacker could us...

PT-2017-15545 · Wolfssl · Wolfssl

Name of the Vulnerable Software and Affected Versions: wolfSSL versions 3.10.2 and earlier Description: A specially crafted x509 certificate can cause a single out of bounds byte overwrite, resulting in potential certificate validation issues, denial of service, and possible remote code execution...

Apple macOS Sierra EAP-TLS Certificate Validation Vulnerability

Apple macOS is an operating system that runs on Apple's Macintosh line of computers. A certificate validation vulnerability exists in Apple macOS EAP-TLS, which can be exploited by remote attackers to bypass security restrictions and obtain sensitive information...