CVE-2020-10659

Entrust Entelligence Security Provider ESP before 10.0.60 on Windows mishandles errors during SSL Certificate Validation, leading to situations where for example a user continues to interact with a web site that has an invalid certificate chain...

CVE-2019-5102

An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt, versions 18.06.4 and 15.05.1. When connecting to a remote server, the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by...

PT-2019-1744 · Cisco · Cisco Ios +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS and IOS XE Software affected versions not specified Description: A vulnerability in the Cisco Smart Call Home feature could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data using an invali...

Security Bulletin: Vulnerability in OpenSSL affects Rational Tau (CVE-2015-1793)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project and affect Rational Tau. This includes the alternate chains certificate forgery vulnerability CVE-2015-1793. Rational Tau has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1793 DESCRIPTION: OpenSSL could...

Apache 2.2.34 2.4.27 - OPTIONS Memory Leak

Apache 2.2.34 2.4.27 - OPTIONS Memory Leak !/usr/bin/env python3 Optionsbleed proof of concept test by Hanno Böck import argparse import urllib3 import re def testbleedurl, args: r = pool.request'OPTIONS', url try: allow = strr.headers"Allow" except KeyError: return False if allow in dup: return...

Multiple Pivotal Software Products Accept Expired Certificates Vulnerability

Pivotal Cloud Foundry PCF, UAA, and UAA-Release are products of Pivotal Software, Inc. of the U.S. PCF is a suite of open-source Platform-as-a-Service PaaS cloud computing platforms that provide features such as container scheduling, continuous delivery, and automated service deployment; UAA is a...

CVE-2017-8058

Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...

ALPINE-CVE-2017-8301

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if SSLgetverifyresult is relied upon for a later check of a verification result, in a use case where a user-provided verification callback returns 1, as demonstrated by acceptance of invalid certificates by nginx...

CVE-2016-5672

Intel Crosswalk before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 interprets a user's acceptance of one invalid X.509 certificate to mean that all invalid X.509 certificates should be accepted without prompting, which makes it easier for...

Grandstream Wave Redirection Vulnerability

Grandstream Wave is a suite of free VoIP applications. Grandstream Wave uses an insecure connection to obtain a configuration file, which allows an attacker to impersonate a configuration server with invalid, mismatched, or expired certificates, redirect phone calls, or cause dialed calls to...

GLSA-201507-15 : OpenSSL: Alternate chains certificate forgery

The remote host is affected by the vulnerability described in GLSA-201507-15 OpenSSL: Alternate chains certificate forgery During certificate verification, OpenSSL attempts to find an alternative certificate chain if the first attempt to build such a chain fails. Impact : A remote attacker could...

Security Advisory - MITM Vulnerability in the OpenSSL Module of Huawei eSight Network

During certificate verification, OpenSSL starting from version 1.0.1n and 1.0.2b will attempt to find an alternative certificate chain if the first attempt to build such a chain fails. An error in the implementation of this logic can mean that an attacker could cause certain checks on untrusted...

DLA-170-1 mod-gnutls - security update

Bulletin has no description...

Debian Security Advisory DSA 2994-1 (nss - security update)

Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library: CVE-2013-1741 Runaway memset in certificate parsing on 64-bit computers leading to a crash by attempting to write 4Gb of nulls. CVE-2013-5606 Certificate validation with the verifylog mode did not...

Oracle Traffic Director Multiple Vulnerabilities (July 2014 CPU)

The remote host is running an unpatched version of Oracle Traffic Director that is affected by the following vulnerabilities : - The implementation of Network Security Services NSS does not ensure that data structures are initialized, which could result in a denial of service or disclosure of...

Oracle iPlanet Web Proxy Server 4.0 < 4.0.24 Multiple Vulnerabilities

The remote host has a version of Oracle iPlanet Web Proxy Server formerly Sun Java System Web Proxy Server 4.0 prior to 4.0.24. It is, therefore, affected by the following vulnerabilities : - The implementation of Network Security Services NSS does not ensure that data structures are initialized,...

Automattic: Missing HSTS header in https://app.simplenote.com

Hi, Vulnerable Website: https://app.simplenote.com I tested the website using firefox add-on called: Strict Transport Security Detector https://addons.mozilla.org/en-US/firefox/addon/strict-transport-security-d/ HSTS addresses the following threats: User bookmarks or manually types...

UBUNTU-CVE-2014-3494

kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate...

Firefox < 25.0.1 NSS and NSPR Multiple Vulnerabilities (Mac OS X)

The installed version of Firefox is a version prior to 25.0.1 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. CVE-2013-1741 - An error exists in the 'NullCipher'...

SeaMonkey < 2.22.1 NSS and NSPR Multiple Vulnerabilities

The installed version of SeaMonkey is a version prior to 2.22.1 and is, therefore, potentially affected by the following vulnerabilities : - An error exists related to handling input greater than half the maximum size of the 'PRUint32' value. CVE-2013-1741 - An error exists in the 'NullCipher'...