cn.yanyvpingsheng:bililive-sdk (0.1.0) potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.3)

com.neovisionaries:nv-websocket-client MAVEN version 1.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - cn.yanyvpingsheng:bililive-sdk 0.1.0 Source cves: CVE-2017-1000209 Source advisory:...

com.rainmatter.kiteconnect:kiteconnect (>=1.0, <=1.4.5) potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.4)

com.neovisionaries:nv-websocket-client MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.rainmatter.kiteconnect:kiteconnect =1.0, =1.4.5 Source cves: CVE-2017-1000209...

com.ibm.watson.developer_cloud:java-sdk (>=2.6.0, <=2.7.0), net.wasdev.wlp.starters.watsonsdk:compile-pom (0.0.1) potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.19)

com.neovisionaries:nv-websocket-client MAVEN version 1.19 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.ibm.watson.developercloud:java-sdk =2.6.0, =2.7.0 -...

com.ibm.watson.developer_cloud:java-sdk (>=2.7.1, <=2.8.0) potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.21)

com.neovisionaries:nv-websocket-client MAVEN version 1.21 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.ibm.watson.developercloud:java-sdk =2.7.1, =2.8.0 Source cves: CVE-2017-1000209...

com.ibm.watson.developer_cloud:java-sdk (>=2.9.0, <=2.10.0), net.wasdev.wlp.starters.watsonsdk:compile-pom (>=0.0.2, <=0.0.4) potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.22)

com.neovisionaries:nv-websocket-client MAVEN version 1.22 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.ibm.watson.developercloud:java-sdk =2.9.0, =0.0.2, =0.0.4 Source cves:...

com.cesanta:cloud-service-stubs (>=0.0.1, <=0.0.3), com.cesanta:clubby (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.23)

com.neovisionaries:nv-websocket-client MAVEN version 1.23 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.cesanta:cloud-service-stubs =0.0.1, =0.0.1, =0.0.3 -...

com.github.czyzby:gdx-websocket-common (>=1.6.1.9.2, <=1.6.1.9.3) potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.25)

com.neovisionaries:nv-websocket-client MAVEN version 1.25 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.github.czyzby:gdx-websocket-common =1.6.1.9.2, =1.6.1.9.3 Source cves:...

com.github.czyzby:gdx-websocket-common (>=1.7.1.9.3-b1, <=1.7.1.9.3) potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.26)

com.neovisionaries:nv-websocket-client MAVEN version 1.26 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.github.czyzby:gdx-websocket-common =1.7.1.9.3-b1, =1.7.1.9.3 Source cves:...

com.github.bilthon:graphenej (>=0.4.2, <=0.4.7-alpha3), com.github.czyzby:gdx-websocket-common (>=1.8.1.9.4-b1, <=1.8.1.9.4) +1 more potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.30)

com.neovisionaries:nv-websocket-client MAVEN version 1.30 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.github.bilthon:graphenej =0.4.2, =1.8.1.9.4-b1, =0.4.0, =0.4.1 Source cves:...

com.clover.sdk:clover-connector-android (>=1.2-rc1, <=1.2), com.clover.sdk:clover-connector-java (3.0.0) +17 more potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (1.31)

com.neovisionaries:nv-websocket-client MAVEN version 1.31 is affected by a known vulnerability. The following packages have a transitive dependency on com.neovisionaries:nv-websocket-client and may be impacted: - com.clover.sdk:clover-connector-android =1.2-rc1, =1.2, =1.3.2, =1.9.1.10.0, =1.2.0,...

Man-in-the-Middle (MitM)

nv-websocket-client is vulnerable to man-in-the-middle MitM attacks. The library accepts a trusted certificate issued to domain A when connecting to domain B, allowing a malicious user to conduct a man-in-the-middle attack...

cn.yanyvpingsheng:bililive-sdk (0.1.0), com.cesanta:cloud-service-stubs (>=0.0.1, <=0.0.3) +26 more potentially affected by CVE-2017-1000209 via com.neovisionaries:nv-websocket-client (>=1.3, <=1.31)

com.neovisionaries:nv-websocket-client MAVEN version =1.3, =0.0.1, =0.0.1, =1.2-rc1, =1.2, =1.3.2, =1.9.1.10.0, =0.4.2, =1.5.1.9.2, =0.4.0, =2.6.0, =1.2.0, =1.0.0, =7.2.0 and more Source cves: CVE-2017-1000209 Source advisory: MEND:CVE-2017-1000209...

CVE-2017-1000209

The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate...

PT-2017-10907

Name of the Vulnerable Software and Affected Versions nv-websocket-client affected versions not specified Description The issue concerns a failure to verify the server hostname against the domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. This allows...

CVE-2017-1000209: Improper Certificate Validation

The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate...