HTTPS MitM vulnerability due to lack of hostname verification

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests. This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch. The problem was addressed by...

RUSTSEC-2016-0002 HTTPS MitM vulnerability due to lack of hostname verification

When used on Windows platforms, all versions of Hyper prior to 0.9.4 did not perform hostname verification when making HTTPS requests. This allows an attacker to perform MitM attacks by preventing any valid CA-issued certificate, even if there's a hostname mismatch. The problem was addressed by...

PT-2016-4588

Name of the Vulnerable Software and Affected Versions hyper crate versions prior to 0.9.4 Description An issue was discovered in the hyper crate for Rust on Windows, allowing an HTTPS man-in-the-middle attack because hostname verification was omitted. This enables an attacker to perform MitM...

RPCScan 2.03 - Hostname/IP Field Overwrite (SEH) (PoC)

!/usr/bin/python Exploit Title : RPCScan v2.03 Hostname/IP Field SEH Overwrite POC Discovery by : Nipun Jaswal Email : [email protected] Discovery Date : 08/05/2016 Vendor Homepage : http://samspade.org Software Link : http://www.mcafee.com/in/downloads/free-tools/rpcscan.aspx Tested Version ...

CIScan 1.00 - HostnameIP Field Crash (PoC)

CIScan 1.00 - HostnameIP Field Crash PoC !/usr/bin/env python -- coding: utf-8 -- Exploit Title : CIScanv1.00 Hostname/IP Field Local BoF PoC Discovery by : Irving Aguilar Email : [email protected] Discovery Date : 05.05.2016 Software Link :...

RPCScan 2.03 - Hostname/IP Field Crash (PoC)

Exploit for windows platform in category dos / poc !/usr/bin/env python -- coding: utf-8 -- Exploit Title : RPCScan v2.03 Hostname/IP Field Local BoF PoC Discovery by : Irving Aguilar Email : email protected Discovery Date : 05.05.2016 Software Link :...

CIScan 1.00 - Hostname/IP Field Crash (PoC)

Exploit for windows platform in category dos / poc !/usr/bin/env python -- coding: utf-8 -- Exploit Title : CIScanv1.00 Hostname/IP Field Local BoF PoC Discovery by : Irving Aguilar Email : email protected Discovery Date : 05.05.2016 Software Link :...

mysql: ssl-validate-cert incorrect hostname check

It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client...

UBUNTU-CVE-2013-7449

The ssldoconnect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

DEBIAN-CVE-2013-7449

The ssldoconnect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-7449

The CVE-2013-7449 issue affects HexChat (before 2.10.2), XChat, and XChat-GNOME, where ssl_do_connect in common/server.c fails to verify that the server hostname matches a domain in the X.509 certificate. This allows MITM attackers to spoof SSL servers using arbitrary valid certificates. The root...

CVE-2013-7449

The ssldoconnect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2013-7449

The ssldoconnect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2015-8702

The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service netsplit via an invalid character in a PTR response, as demonstrated by a "\032" whitespace character in a hostname...

CVE-2015-8702

The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service netsplit via an invalid character in a PTR response, as demonstrated by a "\032" whitespace character in a hostname...

CVE-2015-8702

The DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service netsplit via an invalid character in a PTR response, as demonstrated by a "\032" whitespace character in a hostname...

USN-2945-1 xchat-gnome vulnerability

It was discovered that XChat-GNOME incorrectly verified the hostname in an SSL certificate. An attacker could trick XChat-GNOME into trusting a rogue server's certificate, which was signed by a trusted certificate authority, to perform a machine-in-the-middle attack...

mysql: ssl-validate-cert incorrect hostname check

It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client...

DHCP Hostname HTML Injection

...

Fing v3.3.0 iOS - Persistent Mail Encoding Vulnerability

Document Title: =============== Fing v3.3.0 iOS - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1772 Release Date: ============= 2016-02-28 Vulnerability Laboratory ID VL-ID: ====================================...