CVE-2013-6444

PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

PT-2014-3118

Name of the Vulnerable Software and Affected Versions PyWBEM versions 0.7 and earlier Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because it does not verify that the server hostname matches a domain name in the subject's Common...

KLA10396 SB vulnerability in WinSCP

A lack of hostname verifications was found in the WinSCP. By exploiting this vulnerability malicious users can spoof the SSL server. This vulnerability can be exploited remotely via a man-in-the-middle attack. Original advisories - Related products WinSCP CVE list CVE-2014-2735 high Solution Upda...

PT-2014-4892

Name of the Vulnerable Software and Affected Versions WinSCP versions prior to 5.5.3 Description The issue arises when using FTP with TLS, as it fails to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. This...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

CVE-2014-2522

curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP...

PT-2014-4760

Name of the Vulnerable Software and Affected Versions libcurl versions 7.27.0 through 7.35.0 Description The issue arises when libcurl, built to use the SChannel/Winssl TLS backend on Windows, fails to verify that the server hostname matches a domain name in the subject's Common Name CN or...

MGASA-2014-0133 Updated lighttpd package fixes security vulnerabilities

SQL injection vulnerability in lighttpd before 1.4.35 when modmysqlvhost is in use, due to insufficient validation of hostnames in HTTP requests CVE-2014-2323. Possible path traversal vulnerabilities in lighttpd before 1.4.35 when either modevhost or modsimplevhost are in use, due to insufficient...

UBUNTU-CVE-2014-2323

SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to requestcheckhostname...

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

CVE-2014-1263

CVE-2014-1263 affects curl/libcurl 7.27.0–7.35.0 when using the SecureTransport/Darwinssl backend on macOS (OS X 10.9.x before 10.9.2). The flaw disables hostname verification for certificates when connecting to URLs that use IP addresses, allowing MITM attackers to spoof servers with arbitrary v...

CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

CVE-2014-1263

curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when accessing a...

PT-2014-4049

Name of the Vulnerable Software and Affected Versions curl and libcurl versions 7.27.0 through 7.35.0 Description The issue arises when using the SecureTransport/Darwinssl backend, as seen in Apple OS X 10.9.x before 10.9.2, where the server hostname is not verified to match a domain name in the...

[FGscanner] Find hidden contents using dictionary-like attack

FGscanner is a completely rewritten version of littlescanner script. FGscanner is an opensource advanced web directory scanner to find hidden contents on a web server using dictionary-like attack with proxy and tor support. Quick reference for switches Usage: ./fgscan.pl --host=hostname...

CVE-2013-2214

status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup 1 overview, 2 summary, or 3 grid style i...