Siemens SINUMERIK Integrate Operate Client

1. EXECUTIVE SUMMARY CVSS v3 7.4 ATTENTION : Exploitable remotely Vendor : Siemens Equipment : SINUMERIK Integrate Operate Client Vulnerability : Improper Certificate Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to spoof any SSL server...

CVE-2021-21571

Dell UEFI BIOS https stack leveraged by the Dell BIOSConnect feature and Dell HTTPS Boot feature contains an improper certificate validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability using a person-in-the-middle attack which may lead to a denial of service an...

UBUNTU-CVE-2021-22895

Nextcloud Desktop Client before 3.3.1 is vulnerable to improper certificate validation due to lack of SSL certificate verification when using the "Register with a Provider" flow...

Dell EMC NetWorker Multiple Vulnerabilities (DSA-2021-104)

The version of Dell EMC NetWorker installed on the remote Windows host is prior to 19.4.0.2. It is, therefore, affected by multiple vulnerabilities: - Dell EMC NetWorker 18.x, 19.1.x, 19.2.x, 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A local administrator of the...

GLSA-202105-02 : stunnel: Improper certificate validation

The remote host is affected by the vulnerability described in GLSA-202105-02 stunnel: Improper certificate validation It was discovered that stunnel did not correctly verified the client certificate when options redirect and verifyChain are used. Impact : A remote attacker could send a specially...

GHSA-4F68-49QQ-H392 Improper certificate validation in em-imap

em-imap 0.5 and earlier use the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

GHSA-7359-3C6R-HFC2 Improper Certificate Validation in oauth ruby gem

lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. TLS hostname is not validated sufficiently. Remediation There is no fixed version for tweetstream...

CVE-2021-22511

CVE-2021-22511 affects Micro Focus Application Automation Tools Plugin for Jenkins (versions 6.7 and earlier). It is an improper certificate validation vulnerability where the plugin could unconditionally disable SSL/TLS certificate validation for connections to Service Virtualization servers. Ro...

Input validation

ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device...

Cisco Unified Computing System (UCS) Central Software Improper Certificate Validation (cisco-sa-ucs-invcert-eOpRvCKH)

According to its self-reported version, Cisco Unified Computing System Central Software is affected by an improper certificate validation vulnerability. An authenticated, adjacent attacker could exploit this, by sending a crafted HTTP request to the registration API, to register a rogue Cisco UCS...

CVE-2020-4791

IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to improper certificate validation. IBM X-Force ID: 189379...

Siemens RUGGEDCOM ROX II

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: RUGGEDCOM ROX IIB Vulnerabilities: Improper Input Validation, NULL Pointer Dereference, Out-of-Bounds Write, Insufficient Verification of Data Authenticity, Improper Certificate...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation. DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding...

CentOS 8 : dovecot (CESA-2019:3467)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3467 advisory. - dovecot: Improper certificate validation CVE-2019-3814 Note that Nessus has not tested for this issue but has instead relied only on the application's...

Cisco Firepower Management Center DoS (cisco-sa-fmc-dos-3WymYWKh)

According to its self-reported version, Cisco Firepower Management Center is affected by a denial of service DoS vulnerability in its host input API daemon component due to improper certificate validation. An unauthenticated, local attacker can exploit this issue, by sending a crafted data stream...

CVE-2020-27649

CVE-2020-27649 is an improper certificate validation vulnerability in the OpenVPN client used by Synology SRM. The issue enables MITM attackers to spoof the VPN server and access sensitive data via a crafted certificate on SRM versions prior to 1.2.4-8081. Talos describes an in-depth attack chain...

CVE-2020-4340

IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180...

Input validation

The vulnerability have been reported to affect earlier versions of Helpdesk. If exploited, this improper certificate validation vulnerability could allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. QNAP has already fixed the issue in...

CVE-2018-19946

CVE-2018-19946 affects earlier versions of QNAP Helpdesk. The issue is an improper certificate validation vulnerability, enabling an attacker to spoof a trusted entity by interfering in the communication path between the host and client. Root cause: certificate validation weakness in Helpdesk pri...