CVE-2014-3230

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the 1 HTTPSCADIR or 2 HTTPSCAFILE environment variable...

CVE-2014-3230

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the 1 HTTPSCADIR or 2 HTTPSCAFILE environment variable...

CVE-2014-3230

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the 1 HTTPSCADIR or 2 HTTPSCAFILE environment variable...

CVE-2020-5523

Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information vi...

Trend Micro Password Manager vulnerable to information disclosure

Overview Password Manager provided by Trend Micro Incorporated generates a key pair and a root certificate on product installation. The generated private key is not properly protected and any non-administrative user can retrieve the private key CWE-200. Note that this vulnerability is different...

Secure Hub 10.5 : Enrollment fails with error : "Can't enroll device- WorxHome cannot enroll device because it failed to establish a secure connection with server"

Using an older Secure Hub version confirmed on 10.5, 10.6.0, enrollment fails right after enrollment URL without being able to get to authentication screen with the following: Logs will show the following: 05-03 12:12:29.406 10851 10869 D "SecureHub": "DETAIL...

CVE-2013-0264

An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it...

Code injection

An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it...

CVE-2013-0264

CVE-2013-0264 affects Cumin. The issue is an import error introduced during code refactoring (r5310) that causes server certificate validation to be always disabled when connecting to Aviary servers, even if the system packages support it. This creates a potential integrity risk (partial) and, pe...

CVE-2013-0264

An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it...

CVE-2014-2904

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

Authentication flaw

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

CVE-2014-2904

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

UBUNTU-CVE-2014-2904

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

CVE-2014-2904

CVE-2014-2904 affects wolfSSL prior to 3.2.0, where a server certificate is not properly authorized for server authentication. This has been documented across multiple sources (OSV, NVD, Debian/Ubuntu advisories, and CVE records). The description consistently notes the issue without detailing exp...

CVE-2014-2904

wolfssl before 3.2.0 has a server certificate that is not properly authorized for server authentication...

Security feature bypass

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies...

CVE-2010-4533

CVE-2010-4533 affects offlineimap prior to version 6.3.4, where SSL certificate validation was added but SSLv2 is still enabled. This keeps SSLv2’s known weaknesses and yields high CVSS metrics (Confidentiality/Integrity/Availability partial in CVSS2; Critical in CVSS3.1). The connected documents...

Fortinet FortiSIEM 5.0 / 5.2.1 Improper Certification Validation

Product Name: FortiSIEM Tested versions: 5.0, 5.2.1 Fixed in version: Only a manual workaround is available from Fortinet as of this writing Weakness Type: CWE-295 - Improper Certificate Validation Discovered by: Andrew Klaus Cybera Canada CVE: Pending == Disclosure Timeline: June 25, 2019: Initi...

Elastic APM agent for Ruby 2.9.0 security update

Elastic APM agent for Ruby client authentication flaw ESA-2019-08 A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the ‘servercacert’ setting, the Ruby agent would not properly verify the certifica...