CVE-2025-8476

CVE-2025-8476 concerns Alpine iLX-507 devices, where the TIDAL streaming app suffers from improper certificate validation. The flaw allows a network-adjacent attacker to execute arbitrary code with root privileges, with authentication not required. The issue is documented across multiple sources ...

(0Day) (Pwn2Own) Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the TIDAL music streaming application. The issue results from improper...

(Pwn2Own) QNAP TS-464 reset_password.cgi Improper Certificate Validation Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the lack of proper...

(Pwn2Own) QNAP TS-464 reset_password.cgi Improper Certificate Validation Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the lack of...

CVE-2025-36005

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the...

CVE-2025-36005 IBM MQ Operator information disclosure

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the...

Zoom Workplace Desktop App < 6.4.13 Information Disclosure (ZSB-25023)

The version of Zoom Workplace Desktop App installed on the remote host is prior to 6.4.13. It is, therefore, affected by a vulnerability as referenced in the ZSB-25023 advisory. - Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to...

Improper Certificate Validation

couchbasenetclient is vulnerable to improper certificate validation. The vulnerability is due to improper configuration defaults and lack of hostname verification in TLS connections, defaulting to IP addresses instead of hostnames, which allows an attacker to perform man-in-the-middle MitM attack...

CVE-2025-48802

Improper certificate validation in Windows SMB allows an authorized attacker to perform spoofing over a network...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the SCT extension parsing process. An attacker can access confidential information by providing a specially crafted certificate containing a malformed SCT extension during X.509 certificate verificatio...

CVE-2025-35983

CVE-2025-35983 affects Gallagher Controller 7000. The issue arises from improper certificate validation in the Controller 7000 OneLink implementation during initial configuration, which could allow an unprivileged attacker to cause a limited denial of service or perform privileged overrides. The ...

CVE-2025-35983

Improper Certificate Validation CWE-295 in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of service or perform privileged overrides during the initial configuration of the Controller, there is no risk for Controllers once they are...

CVE-2025-7095

A vulnerability classified as critical has been found in Comodo Internet Security Premium 12.3.4.8162. This affects an unknown part of the component Update Handler. The manipulation leads to improper certificate validation. It is possible to initiate the attack remotely. The complexity of an atta...

Comodo Internet Security Premium 信任管理问题漏洞

Comodo Internet Security Premium is a suite of computer security software from Comodo, Inc. that focuses on Internet security. A trust management issue vulnerability exists in Comodo Internet Security Premium version 12.3.4.8162, which stems from an improper certificate validation in the update...

CVE-2025-34066

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle MITM attacks...

QNAP File Station 5 Trust Management Issues Vulnerability (CNVD-2025-15402)

QNAP File Station 5 is a file management system launched by Weilian Technology, which is mainly used for file management of NAS devices. A trust management issue vulnerability exists in QNAP File Station 5, which stems from improper certificate validation, and can be exploited by an attacker to...

TencentOS Server 3: libreoffice (TSSA-2022:0242)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2022:0242 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Improper Certificate Validation

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

Improper Certificate Validation

Overview salt is a new approach to infrastructure management built on a dynamic communication bus. Salt can be used for data-driven orchestration, remote execution for any infrastructure, configuration management for any app stack, and much more. Affected versions of this package are vulnerable t...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via a vulnerable LeeEirc\crypto dependency. An attacker can utilize a disclosed public key to attempt brute-force authentication against the SSH service. Note: While the vulnerability exists in...