484 matches found
Design/Logic Flaw
In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...
UBUNTU-CVE-2020-24392
In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...
CVE-2020-24393
CVE-2020-24393 affects TweetStream 2.6.1. The vulnerability arises from insecure use of the eventmachine library that omits TLS hostname validation, enabling potential man-in-the-middle attacks. Public sources (including Red Hat, OSV, MV sources) reiterate the same description and do not specify ...
CVE-2020-24392
CVE-2020-24392 concerns missing TLS hostname validation in voloko twitter-stream (versions 0.1.10 and 0.1.16 in various advisories), caused by misused eventmachine. This allows a man-in-the-middle attack against users of the library. The vulnerability is described across multiple sources (Red Hat...
Hostname Validation Bypass
sanitize-html is vulnerable to hostname validation bypass. The package does not properly validate the iframe hostname in URL parser, allowing an IDNA Internationalized Domain Name iframe attack...
LG mobile with Android OS security vulnerability
LG mobile is a family of mobile devices from LG. A security vulnerability exists in LG Mobile devices Google Android OS 8.0, 8.1, 9.0, and 10 software that stems from improper handling of the default value for hostname validation in a preloaded application...
org.eclipse.paho.client.mqttv3: Improper hostname validation in the MQTT library
In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information...
Opencast Access Control Error Vulnerability
Opencast is a live video support software for large-scale automated video capture, management and distribution from the Opencast organization. A security vulnerability exists in Opencast versions 8.9 and prior to 7.9 that stems from Opencast disabling HTTPS hostname validation, which is used by i...
jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM
Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server...
RHEL 7 : OpenShift Container Platform 3.11.318 jenkins-2-plugins (RHSA-2020:5102)
The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:5102 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...
Man-in-the-Middle (MitM)
jenkins-2-plugins/mailer is vulnerable to man-in-the-middle attack. Missing hostname validation in Mailer Plugin allows an attacker to perform man-in-the-middle attacks...
RHEL 7 / 8 : OpenShift Container Platform 4.6.1 (RHSA-2020:4297)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4297 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use...
jenkins-2-plugins/mailer: Missing hostname validation in Mailer Plugin could result in MITM
Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server...
systemd 239 through 245 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent)
...
Man-in-the-Middle (MitM)
twitter-stream is vulnerable to man-in-the-middle MitM. Lack of hostname validation allows an attacker to perform a man-in-the-middle attack to intercept and modify network traffic...
CVE-2020-2252
Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server...
CloudBees Jenkins Email Extension Trust Management Issue Vulnerability
CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A security vulnerability exis...
CVE-2020-2253
Jenkins Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server...
