CVE-2020-13245: Improper Certificate Validation

Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.61.2.19 through 1.0.11.10010.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P...

CVE-2020-13645: Improper Certificate Validation

In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate...

CVE-2020-13615: Improper Certificate Validation

lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates...

CVE-2020-13614: Improper Certificate Validation

An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implementation lacks hostname verification...

CVE-2020-13616: Improper Certificate Validation

The boost ASIO wrapper in net/asio.cpp in Pichi before 1.3.0 lacks TLS hostname verification...

CVE-2020-13482: Improper Certificate Validation

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

CVE-2020-13163: Improper Certificate Validation

em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

CVE-2020-10059: Improper Certificate Validation

The UpdateHub module disables DTLS peer checking, which allows for a man in the middle attack. This is mitigated by firmware images requiring valid signatures. However, there is no benefit to using DTLS without the peer checking. See NCC-ZEP-018 This issue affects: zephyrproject-rtos zephyr versi...

CVE-2020-12637: Improper Certificate Validation

Zulip Desktop before 5.2.0 has Missing SSL Certificate Validation because all validation was inadvertently disabled during an attempt to recognize the ignoreCerts option...

CVE-2020-2187: Improper Certificate Validation

Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks...

CVE-2020-12144: Improper Certificate Validation

The certificate used to identify the Silver Peak Cloud Portal to EdgeConnect devices is not validated. This makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted portal...

CVE-2020-12143: Improper Certificate Validation

The certificate used to identify Orchestrator to EdgeConnect devices is not validated, which makes it possible for someone to establish a TLS connection from EdgeConnect to an untrusted Orchestrator...

CVE-2020-1952: Improper Certificate Validation

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely...

CVE-2020-9488: Improper Certificate Validation

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

CVE-2020-11806: Improper Certificate Validation

In MailStore Outlook Add-in and Email Archive Outlook Add-in through 12.1.2, the login process does not validate the validity of the certificate presented by the server...

CVE-2020-5864: Improper Certificate Validation

In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default...

Scientific Linux Security Update : dovecot on SL7.x x86_64 (20200407)

dovecot: Improper certificate validation dovecot: Buffer overflow in indexer-worker process results in privilege escalation C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid135805; scriptversion"1.3";...

CVE-2019-4654: Improper Certificate Validation

IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. IBM X-ForceID: 170965...

CentOS 7 : dovecot (RHSA-2020:1062)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1062 advisory. - It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a val...

CVE-2020-7922: Improper Certificate Validation

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...