484 matches found
Input validation
Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server...
CVE-2020-2252
Jenkins Mailer Plugin 1.32 and earlier does not perform hostname validation when connecting to the configured SMTP server...
PT-2020-15477 · Jenkins · Jenkins Email Extension Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Email Extension Plugin versions 2.75 and earlier Description: The issue is related to the lack of hostname validation when connecting to the configured SMTP server. This could be exploited using a man-in-the-middle attack to intercept...
PT-2020-15476 · Jenkins · Jenkins Mailer Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Mailer Plugin versions 1.32 and earlier Description: The issue is related to the lack of hostname validation when connecting to the configured SMTP server. This could be exploited using a man-in-the-middle attack to intercept...
Ruby: Net::SMTP with tls allows forged certificates as long as the hostname matches
I'd like to report a very odd behavior I observed in the Net::SMTP module, part of Ruby's standard library. It seems when performing a TLS connection the code checks the certificate hostname, but not the certificate signature or issuer. This of course makes little sense, as an attacker can create...
PYSEC-2020-252
The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName...
Debian: Security Advisory (DSA-4732-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Couchbase Server Java SDK Trust Management Issue Vulnerability
Couchbase Server is a distributed open source NoSQL non-relational database of the U.S. Couchbase company , which mainly supports data query , full-text search and active global replication , etc. The Java SDK is one of the SDK Software Development Kit used to support Java applications to access...
OPENSUSE-SU-2020:0765-1 Security update for imapfilter
This update for imapfilter fixes the following issues: Imapfilter was updated to version 2.6.16 including the following security issue: - CVE-2016-10937: Added Support for SSL hostname validation boo1149931. This update was imported from the openSUSE:Leap:15.1:Update update project...
Security update for imapfilter (moderate)
openSUSE Security Update: Security update for imapfilter Announcement ID: openSUSE-SU-2020:0765-1 Rating: moderate References: 1149931 Cross-References: CVE-2016-10937 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This updat...
Axel Trust Management Issues Vulnerabilities
Axel is a lightweight download gas pedal. A security vulnerability exists in the ssl.c file in versions of Axel prior to 2.17.8 that stems from a TLS connection failing to validate the server's hostname. No details of the vulnerability are provided at this time...
Qore Trust Management Issues Vulnerabilities
Qore is an embedded multithreaded scripting programming language. A trust management issue vulnerability exists in the lib/QoreSocket.cpp file in versions of Qore prior to 0.9.4.2, which stems from the program failing to validate the hostname of an X.509 certificate. No details of the vulnerabili...
openSUSE Security Update : imapfilter (openSUSE-2020-673)
This update for imapfilter fixes the following issues : Imapfilter was updated to version 2.6.16 including the following security issue : - CVE-2016-10937: Added Support for SSL hostname validation boo1149931. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...
OPENSUSE-SU-2020:0673-1 Security update for imapfilter
This update for imapfilter fixes the following issues: Imapfilter was updated to version 2.6.16 including the following security issue: - CVE-2016-10937: Added Support for SSL hostname validation boo1149931...
em-imap Trust Management Issue Vulnerability
em-imap is an IMAP client based on EventMachine by Conrad Irwin Software developers. A security vulnerability exists in version 0.5 of em-imap, which stems from the program not validating the hostname of the TLS server credentials. An attacker could exploit this vulnerability to conduct a...
Red Hat Keycloak Trust Management Issues Vulnerability
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A trust management issue vulnerability exists in Red Hat Keycloak versions prior to 10.0.0, which stems from a failure to properly perform TLS...
Java-WebSocket Trust Management Issue Vulnerability
Java-WebSocket is a WebSocket client and server implementation written in Java language . A security vulnerability exists in Java-WebSocket 1.4.1 and earlier versions that stems from WebSocketClient failing to validate SSL hostnames. No details of the vulnerability are provided at this time...
CVE-2020-11050 Improper Validation of Certificate with Host Mismatch in Java-WebSocket
In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0...
CloudBees Jenkins Amazon EC2 Plugin Trust Management Issue Vulnerability
CloudBees Jenkins Hudson Labs is a set of Java-based development of the United States CloudBees continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Amazon EC2 Plugin is used in which an EC2 connection...