Libre Office 7.2.x < 7.2.7, 7.3.x < 7.3.2 Improper Certificate Validation Vulnerability (Jul 2022) - Linux

Libre Office is prone to an improper certificate validation vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2022-26305 Execution of Untrusted Macros Due to Improper Certificate Validation

An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the...

CVE-2022-26305

The vulnerability CVE-2022-26305 affects The Document Foundation LibreOffice, where macro signing verification was weakened by validating a certificate only via serial number and issuer string, not the actual signature. This could allow an attacker to craft a certificate that matches a trusted au...

CVE-2022-26306 Execution of Untrusted Macros Due to Improper Certificate Validation

LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice existed where the required initialization vector for encryption was always the same which...

Pidgin < 2.14.9 Improper Certificate Validation Vulnerability - Windows

Pidgin is prone to an improper certificate validation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Pidgin < 2.14.9 Improper Certificate Validation Vulnerability - Linux

Pidgin is prone to an improper certificate validation vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

GHSA-7943-82JG-WMW5 Argo CD certificate verification is skipped for connections to OIDC providers

Impact All versions of Argo CD starting with v0.4.0 are vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious or otherwise untrustworthy OIDC provider. Note: external OIDC provider support was added in v0.11.0. Before that version, the notes below app...

CVE-2022-31105 Argo CD's certificate verification is skipped for connections to OIDC providers

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious or otherwise untrustworthy OpenID Connect OIDC...

Fortinet FortiOS < 6.4 MitM (FG-IR-18-292)

An improper certificate validation vulnerability in FortiOS allows an adjacent, unauthenticated attacker to man-in-the-middle communication. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable, Inc...

Protect

An improper certificate validation vulnerability CWE-295 in FortiOS, FortiAnalyzer, FortiManager, and FortiSandbox may allow a network adjacent and unauthenticated attacker to man-in-the-middle the communication between the listed products and some external peers...

CVE-2020-26184

Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability...

Input validation

Dell BSAFE Micro Edition Suite, versions prior to 4.5.1, contain an Improper Certificate Validation vulnerability...

CVE-2020-26184

CVE-2020-26184 affects Dell BSAFE Micro Edition Suite prior to 4.5.1. The vulnerability is improper certificate validation in the library/component, with a CVSSv3 base score of 7.5 (HIGH) and network vector with no privileges required. Affected versions must be updated to 4.5.1 or later to resolv...

CVE-2022-29082

Dell EMC NetWorker versions 19.1.x, 19.1.0.x, 19.1.1.x, 19.2.x, 19.2.0.x, 19.2.1.x 19.3.x, 19.3.0.x, 19.4.x, 19.4.0.x, 19.5.x,19.5.0.x, 19.6 and 19.6.0.1 and 19.6.0.2 contain an Improper Validation of Certificate with Host Mismatch vulnerability in Rabbitmq port 5671 which could allow remote...

GHSA-6CWM-WM82-HGRW MongoDB Tools Improper Certificate Validation vulnerability

Usage of specific command line parameter in MongoDB Tools which was originally intended to just skip hostname checks, may result in MongoDB skipping all certificate validation. This may result in accepting invalid certificates.This issue affects: MongoDB Inc. MongoDB Database Tools 3.6 versions...

GHSA-862J-CV9P-6HPF Jenkins Codefresh Integration Plugin Improper Certificate Validation vulnerability

Codefresh Integration Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. As of publication of this advisory, there is no fix...

Helm Improper Certificate Validation

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm many files updated, see...

Hybrid Group Gobot Improper Certificate Validation vulnerability

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default. Specific Go Packages Affected github.com/hybridgroup/gobot/platforms/mqtt...

GHSA-VFXC-R2GX-V2VQ Hybrid Group Gobot Improper Certificate Validation vulnerability

An issue was discovered in Hybrid Group Gobot before 1.13.0. The mqtt subsystem skips verification of root CA certificates by default. Specific Go Packages Affected github.com/hybridgroup/gobot/platforms/mqtt...

CVE-2022-29222 Improper Certificate Validation in Pion DTLS

Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. This issue affects users that are using Client certificates only. The connection...