CVE-2020-13616

The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification...

Man-in-the-Middle (MitM)

Overview em-http-request is an EventMachine based, async HTTP Request client. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. The library eventmachine is being used in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the...

PT-2020-13616

Name of the Vulnerable Software and Affected Versions Qore versions prior to 0.9.4.2 Description The issue is related to a lack of hostname verification for X.509 certificates in the lib/QoreSocket.cpp file. This could potentially allow for certain types of attacks. Recommendations For versions...

PT-2020-13617

Name of the Vulnerable Software and Affected Versions Pichi versions prior to 1.3.0 Description The issue is related to the boost ASIO wrapper in the net/asio.cpp file, which lacks TLS hostname verification. Recommendations For versions prior to 1.3.0, update to version 1.3.0 or later to resolve...

PT-2020-13615

Name of the Vulnerable Software and Affected Versions Axel versions prior to 2.17.8 Description An issue was discovered in the TLS implementation of Axel, where it lacks hostname verification. This issue is related to the ssl.c file. Recommendations For versions prior to 2.17.8, update to version...

CVE-2020-13616: Improper Certificate Validation

The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification...

CVE-2020-13614: Improper Certificate Validation

An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification...

CVE-2020-13615: Improper Certificate Validation

lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates...

openSUSE Security Update : imapfilter (openSUSE-2020-673)

This update for imapfilter fixes the following issues : Imapfilter was updated to version 2.6.16 including the following security issue : - CVE-2016-10937: Added Support for SSL hostname validation boo1149931. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

CVE-2020-13482

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

OPENSUSE-SU-2020:0673-1 Security update for imapfilter

This update for imapfilter fixes the following issues: Imapfilter was updated to version 2.6.16 including the following security issue: - CVE-2016-10937: Added Support for SSL hostname validation boo1149931...

Security Bulletin: Vulnerabilities exist in Watson Explorer Analytical Components and Watson Content Analytics (CVE-2018-8039, CVE-2017-1788)

Summary Security vulnerabilities have been identified in IBM Watson Explorer Analytical Components, Watson Explorer Foundational Components Annotation Administration Console, and IBM Watson Content Analytics. Vulnerability Details CVEID: CVE-2018-8039 DESCRIPTION: Apache CXF could allow a remote...

em-imap Trust Management Issue Vulnerability

em-imap is an IMAP client based on EventMachine by Conrad Irwin Software developers. A security vulnerability exists in version 0.5 of em-imap, which stems from the program not validating the hostname of the TLS server credentials. An attacker could exploit this vulnerability to conduct a...

Man-in-the-Middle (MitM)

Overview em-imap is a gem that allows you to connect to an IMAP4rev1 server in a non-blocking fashion. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. The hostname in a TLS server certificate is not verified. An attacker can assume the identity of a trusted server and...

DEBIAN-CVE-2020-10030

An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker with enough privileges to change the system's hostname to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where gethostname does not...

CVE-2020-10030

An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker with enough privileges to change the system's hostname to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where gethostname does not...

UBUNTU-CVE-2020-10030

An issue has been found in PowerDNS Recursor 4.1.0 up to and including 4.3.0. It allows an attacker with enough privileges to change the system's hostname to cause disclosure of uninitialized memory content via a stack-based out-of-bounds read. It only occurs on systems where gethostname does not...

PT-2020-13366

Name of the Vulnerable Software and Affected Versions em-imap versions 0.5 and earlier Description The issue allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the insecure use of the eventmachine library, which fails to verify the hostname in a...

Red Hat Keycloak Trust Management Issues Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A trust management issue vulnerability exists in Red Hat Keycloak versions prior to 10.0.0, which stems from a failure to properly perform TLS...

CVE-2020-1758

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle MITM attack...