7959 matches found
CVE-2014-5889
The CVE-2014-5889 incident concerns the Android Forums (com.tapatalk.androidforumscom) Android app, version 2.4.4.9, which fails to verify X.509 certificates when connecting to SSL servers. Root cause: improper TLS/SSL validation enabling man-in-the-middle attackers to spoof servers and access se...
Updated libgadu packages fix CVE-2013-4488
Updated libgadu packages fix security vulnerability: Libgadu before 1.12.0 was found to not be performing SSL certificate validation CVE-2013-4488...
MGASA-2014-0375 Updated libgadu packages fix CVE-2013-4488
Updated libgadu packages fix security vulnerability: Libgadu before 1.12.0 was found to not be performing SSL certificate validation CVE-2013-4488...
Ubuntu 14.04 LTS : NSS vulnerability (USN-2343-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2343-1 advisory. Tyson Smith and Jesse Schwartzentruber discovered that NSS contained a race condition when performing certificate validation. An attacker could use this issue to...
USN-2343-1 nss vulnerability
Tyson Smith and Jesse Schwartzentruber discovered that NSS contained a race condition when performing certificate validation. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code...
CVE-2014-5803
The Towers N' Trolls aka project.android.ftdjni application 1.6.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5768
The CVE-2014-5768 entry concerns the Android app Food Planner (aka dk.boggie.madplan.android) version 4.8.4.3-google. The vulnerability is that the app does not verify X.509 certificates from SSL/TLS servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information v...
CVE-2014-5721
The CVE-2014-5721 issue affects Touchnote Postcards (com.touchnote.android) app for Android, version 4.2.7, where the SSL/TLS implementation does not verify X.509 certificates. Root cause: no certificate verification enables man-in-the-middle attackers to spoof servers and capture sensitive infor...
CVE-2014-5573
The Appstros - FREE Gift Cards! aka com.appstros.main application 1.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Design/Logic Flaw
The Hidden Object - Alice Free aka air.com.differencegames.hovisionsofalicefree application 1.0.17 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5640
The CVE-2014-5640 entry concerns the Android app CM Backup -Restore,Cloud,Photo (com.ijinshan.kbackup) version 1.1.0.135, which fails to verify X.509 certificates when connecting to SSL servers. This allows MITM attackers to spoof servers and access sensitive information via a crafted certificate...
CVE-2014-5678
The CVE-2014-5678 entry concerns the Android app IQ Test (com.pophub.androidiqtest.free) version 3.3, which fails to verify X.509 certificates when connecting to SSL servers. The root cause is SSL certificate validation being bypassed, enabling MITM attackers to spoof servers and extract sensitiv...
CVE-2014-5578
The CVE-2014-5578 entry describes the Trading 212 FOREX Android app prior to version 2.0.9 failing to verify X.509 certificates from SSL servers. Root cause: improper SSL/TLS certificate validation, enabling MITM attackers to spoof servers and extract sensitive information through a crafted certi...
CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...
Information disclosure
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
PT-2014-5412 · Apache +3 · Apache Axis +3
Name of the Vulnerable Software and Affected Versions: Apache Axis versions 1.4 and earlier Description: The issue arises from the getCN function not properly verifying that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate...
Apache Subversion multiple security vulnerabilities
DoS, information leakage, certificate validation bypass...
Puppet Enterprise 2.8.x / 3.2.x Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise application installed on the remote host is version 2.8.x or 3.2.x. It is, therefore, affected by multiple vulnerabilities : - An error exists in the 'dossl3write' function that permits a NULL pointer to be dereferenced, which...
nss: IDNA hostname matching code does not follow RFC 6125 recommendation (MFSA 2014-45)
It was found that the implementation of Internationalizing Domain Names in Applications IDNA hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid...