Vulnerabilities include agents for data collection and delivery in Elasticsearch or Logstash Elastic Beats, agents for collecting metrics in Elastic Agent, server software for monitoring and analyzing application performance in Elastic APM Server, server software for managing agents in Elastic Fleet Server. Issues also involve errors in the TLS certificate validation process, allowing attackers to establish connections with invalid server certificates.

The vulnerability affects agents for data collection and delivery in Elasticsearch or Logstash Elastic Beats, agents for collecting metrics in Elastic Agent, server software for monitoring and analyzing application performance in Elastic APM Server, and server software for managing agents in...

Denial Of Service

Squid is vulnerable to Denial Of Service. The vulnerability is due to improper validation of particular index which allows an attacker to initiate a TLS Handshake with a malicious crafted SSL Certificate in a server certificate chain thus leading to denial of service...

UBUNTU-CVE-2023-46724

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to...

CVE-2023-31421 Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue

It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server certificate is valid for the target IP address; however, certificate signature validation is still performed. More specifically, when the client is configured to...

Elasticsearch Security Vulnerabilities

Elasticsearch is a search engine based on the Lucene library. A security vulnerability exists in Elasticsearch that stems from the fact that Beats, Elastic Agent, APM Server, Fleet Server, when used as a TLS client, does not verify that the server certificate is valid for the target IP address...

PT-2023-7073 · Elastic · Apm Server +3

Name of the Vulnerable Software and Affected Versions: Beats affected versions not specified Elastic Agent affected versions not specified APM Server affected versions not specified Fleet Server affected versions not specified Description: The issue is related to errors in the TLS certificate...

JVN#02058996: HP ThinUpdate vulnerable to improper server certificate verification

HP ThinUpdate provided by HP Development Company, L.P. is vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication or alter the communication. Solution Update the Software Update the software...

CVE-2023-45613

The CVE-2023-45613 entry concerns JetBrains Ktor prior to 2.3.5 where server certificates are not verified, creating a trust-management vulnerability. The Red Hat/EUVD/OSV/etc. entries and PT-2023-29593 describe the issue consistently as a failure to validate server certificates in Ktor versions ...

JetBrains Ktor Trust Management Issues Vulnerability

The JetBrains Ktor framework is a web application framework from the Czech company JetBrains. A trust management issue vulnerability exists in JetBrains Ktor versions prior to 2.3.5, which stems from a failure to validate server certificates, resulting in a trust management issue vulnerability...

CWA for iOS: Cannot verify this server's certificate

Starting with Citrix Workspace App version 20.9, adding an account on the Workspace app gives an error "Cannot verify this server's certificate: . The server might not be secure. To continue access, tap Setup and check "Ignore certificate warning"...

CVE-2023-21242

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Privilege escalation

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Certificate trust error after updating SSL server certificate from new Intermediate or Root CA.

After updating a server SSL certificate, users are receiving certificate error "You have not chosen to trust 'DigiCert Global Root G2', the issuer of the server's security certificate.", "NET::ERRCERTAUTHORITYINVALID" or other certificate trust error...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates from a logic error in the code of the isServerCertChainValid module of InsecureEapNetworkHandler.java, which can be exploited by an attacke...

CVE-2023-3615

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection...

CVE-2023-3615 Lack of server certificate validation in websockets connection

Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection allowing a network attacker to intercept the WebSockets connection...

PT-2023-25456 · Mattermost · Mattermost Ios App

Name of the Vulnerable Software and Affected Versions: Mattermost iOS app affected versions not specified Description: The Mattermost iOS app fails to properly validate the server certificate while initializing the TLS connection, allowing a network attacker to intercept the WebSockets connection...

CVE-2023-35142

Jenkins Checkmarx Plugin 2022.4.3 and earlier disables SSL/TLS validation for connections to the Checkmarx server by default...

CVE-2023-29501

Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earlier are vulnerable to improper server certificate verification. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to...

Input validation

Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earlier are vulnerable to improper server certificate verification. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to...