Information disclosure

An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification...

Code injection

lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates...

Design/Logic Flaw

The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification...

CVE-2020-13614

An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification...

UBUNTU-CVE-2020-13614

An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification...

CVE-2020-13614

Axel (SSL/TLS) vulnerability CVE-2020-13614 affects Axel before 2.17.8, where the TLS hostname verification is not performed in ssl.c. This could allow an attacker to impersonate a server and obtain sensitive information. Public sources in the connected documents indicate that updates addressing ...

CVE-2020-13614

An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification...

CVE-2020-13614

An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification...

CVE-2020-13615

CVE-2020-13615 affects Qore up to version 0.9.4.2; the root cause is missing hostname verification for X.509 certificates in lib/QoreSocket.cpp. This constitutes a trust-management vulnerability in TLS connections. Remediation/mitigation: upgrade to Qore 0.9.4.2 or later (as indicated by Red Hat/...

CVE-2020-13615

lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates...

CVE-2020-13616

The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification...

CVE-2020-13616

CVE-2020-13616 affects Pichi prior to 1.3.0: the boost ASIO wrapper in net/asio.cpp does not verify TLS hostnames, enabling hostname validation bypass over TLS. CVSS data from NVD indicates a Network attack vector with MEDIUM base impact for confidentiality (PARTIAL) and no integrity/availability...

Man-in-the-Middle (MitM)

Overview em-http-request is an EventMachine based, async HTTP Request client. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. The library eventmachine is being used in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the...

openSUSE Security Update : imapfilter (openSUSE-2020-673)

This update for imapfilter fixes the following issues : Imapfilter was updated to version 2.6.16 including the following security issue : - CVE-2016-10937: Added Support for SSL hostname validation boo1149931. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

CVE-2020-13482

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

OPENSUSE-SU-2020:0673-1 Security update for imapfilter

This update for imapfilter fixes the following issues: Imapfilter was updated to version 2.6.16 including the following security issue: - CVE-2016-10937: Added Support for SSL hostname validation boo1149931...

Security Bulletin: Vulnerabilities exist in Watson Explorer Analytical Components and Watson Content Analytics (CVE-2018-8039, CVE-2017-1788)

Summary Security vulnerabilities have been identified in IBM Watson Explorer Analytical Components, Watson Explorer Foundational Components Annotation Administration Console, and IBM Watson Content Analytics. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote...

em-imap Trust Management Issue Vulnerability

em-imap is an IMAP client based on EventMachine by Conrad Irwin Software developers. A security vulnerability exists in version 0.5 of em-imap, which stems from the program not validating the hostname of the TLS server credentials. An attacker could exploit this vulnerability to conduct a...

Man-in-the-Middle (MitM)

Overview em-imap is a gem that allows you to connect to an IMAP4rev1 server in a non-blocking fashion. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. The hostname in a TLS server certificate is not verified. An attacker can assume the identity of a trusted server and...

DEBIAN-CVE-2020-10030

An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker with enough privileges to change the system's hostname to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where gethostname does not...