mysql: ssl-validate-cert incorrect hostname check

It was found that the MariaDB client library did not properly check host names against server identities noted in the X.509 certificates when establishing secure connections using TLS/SSL. A man-in-the-middle attacker could possibly use this flaw to impersonate a server to a client...

drchrono: SSL/TLS BEAST ATTACK

Supported versions: TLSv1.0 TLSv1.1 TLSv1.2 Deflate compression: no Supported cipher suites ORDER IS NOT SIGNIFICANT: TLSv1.0 RSAWITH3DESEDECBCSHA RSAWITHAES128CBCSHA RSAWITHAES256CBCSHA TLSECDHERSAWITH3DESEDECBCSHA TLSECDHERSAWITHAES128CBCSHA TLSECDHERSAWITHAES256CBCSHA TLSv1.1: idem TLSv1.2...

Amazon Linux AMI : mysql56 (ALAS-2016-701)

A double-free flaw was found in the way OpenSSL parsed certain malformed DSA Digital Signature Algorithm private keys. An attacker could create specially crafted DSA private keys that, when processed by an application compiled against OpenSSL, could cause the application to crash. CVE-2016-0705 T...

Veris: SSL/TLS BEAST ATTACK VULNERABILITY

hello, i m pentesting sandbox.veris.in and found that it is vulnerable to SSL/TLS BEAST ATTACK vulnerability at port 443. PoC Supported versions: TLSv1.0 TLSv1.1 TLSv1.2 Deflate compression: no Supported cipher suites ORDER IS NOT SIGNIFICANT: TLSv1.0 RSAWITH3DESEDECBCSHA DHERSAWITH3DESEDECBCSHA...

Tokyo Star bank App Information Disclosure Vulnerability

Tokyo Star bank App for Android and iOS is a suite of banking apps for the Android and iOS platforms from Tokyo Star Bank in Japan. The Tokyo Star bank App for Android and iOS fails to validate server-side SSL certificates, allowing an attacker to exploit this vulnerability to conduct...

Akerun - Smart Lock Robot App for iOS fails to verify SSL server certificates

Overview Akerun - Smart Lock Robot App for iOS provided by Photosynth Inc. fails to verify SSL server certificates. Kenta Suefusa, Tomonori Shiomi of Sprout Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impa...

MariaDB MITM Vulnerability (MDEV-9212) - Linux

MariaDB is prone to a man-in-the-middle MITM vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mariadb:mariadb";...

Secure Mail Error: "Cannot Safely connect to the server. The server certificate is not trusted."

New Users: When attempting to connect to Secure Mail, new users encounter the following error message: "Cannot safely connect to the server. The server's certificate is not trusted." Already Enrolled Users: Already enrolled users experience the error message: "Access to your company network is no...

RedHat Update for squid RHSA-2015:2378-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubiquiti Networks Hardcoded Keys / Remote Management

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure default configuration product: various Ubiquiti Networks products vulnerable version: see Vulnerable / tested versions fixed version: none available impact: High...

JVN#25086409: ANA App fails to verify SSL server certificates

ANA App provided by ALL NIPPON AIRWAYS CO., LTD fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided by the...

USN-2709-2 pollinate update

USN-2709-1 updated pollinate's certificate for entropy.ubuntu.com but did not include a new certificate authority certificate. This update fixes the problem. We apologize for the inconvenience. Original advisory details: The pollinate package bundles the certificate for entropy.ubuntu.com. This...

Flawed TLS Implementations Leak RSA Keys

A number of TLS software implementations contain vulnerabilities that allow hackers with minimal computational expense to learn RSA keys. Florian Weimer, a researcher with Red Hat, last week published a paper called “Factoring RSA Keys With TLS Perfect Forward Secrecy” that demonstrated...

USN-2709-1 pollinate update

The pollinate package bundles the certificate for entropy.ubuntu.com. This update refreshes the certificate to match the new certificate for the server...

foreman: lack of SSL certificate validation when performing LDAPS authentication

It was found that when making an SSL connection to an LDAP authentication source in Foreman, the remote server certificate was accepted without any verification against known certificate authorities, potentially making TLS connections vulnerable to man-in-the-middle attacks...

Egress-Assess - Tool used to Test Egress Data Detection Capabilities

Egress-Assess is a tool used to test egress data detection capabilities. Setup To setup, run the included setup script, or perform the following: 1. Install pyftpdlib 2. Generate a server certificate and store it as "server.pem" on the same level as Egress-Assess. This can be done with the...

DLA-244-1 strongswan - security update

Bulletin has no description...

squid insufficient certificate validation

Insufficient check for server certificate...

Apple Mac OS X Using Open Directory Plaintext Password Delivery Vulnerability

Apple Mac OS X is an operating system developed by Apple Inc. When the Apple Mac OS X service binds an Open Directory client but fails to install an OS X server certificate, the client sends password changes in clear text, which can be exploited by remote attackers to obtain sensitive information...

SSL/TLS: Hostname discovery from server certificate

It was possible to discover an additional hostname of this server from its certificate Common or Subject Alt Name. Copyright C 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...