Design/Logic Flaw

The client in OpenText Exceed OnDemand EoD 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obtain sensitive information via crafted responses...

CVE-2013-6807

CVE-2013-6807 affects OpenText Exceed OnDemand (EoD) 8. The vulnerability arises because the client supports anonymous ciphers by default, enabling man-in-the-middle attackers to bypass server certificate validation, redirect connections, and obtain sensitive information from crafted responses. R...

CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

Code injection

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

CVE-2011-4407

ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle MITM attackers to spoof GPG keys for a package repository...

CVE-2014-3230

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the 1 HTTPSCADIR or 2 HTTPSCAFILE environment variable...

VMware vSphere Client Multiple Vulnerabilities (VMSA-2014-0003)

The version of vSphere Client installed on the remote Windows host is affected by the following vulnerabilities : - An error exists related to the vSphere Client that could allow an updated vSphere Client to be downloaded from an untrusted source. CVE-2014-1209 - An error exists related to the...

Threat Outbreak Alert: Fake Server Certificate Installation Notice Email Messages on March 16, 2014

Medium Alert ID: 33363 First Published: 2014 March 17 14:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a server upgrade certificate notification for the recipient. The text in the email message attempts to convince...

Google Releases Google Chrome Update

Google has released Google Chrome 33.0.1750.124 for several Chrome OS devices to address multiple vulnerabilities, one of which could allow a server certificate to change in a renegotiation. Users and administrators are encouraged to review the Google Chrome release blog entry and apply the updat...

Fedora 19 : libgadu-1.12.0-0.2.rc1.fc19 (2013-23517)

From upstream changelog : - Support for Gadu-Gadu 11 protocol. - Enable server certificate verification. - Allow using custom TCP/TLS connection functions. - Allow specifying server by name, not just IP. - Small bugfixes reported by Pidgin project based on Coverity audit. Note that Tenable Networ...

Fedora 20 : libgadu-1.12.0-0.2.rc1.fc20 (2013-23260)

From upstream changelog : - Support for Gadu-Gadu 11 protocol. - Enable server certificate verification. - Allow using custom TCP/TLS connection functions. - Allow specifying server by name, not just IP. - Small bugfixes reported by Pidgin project based on Coverity audit. Note that Tenable Networ...

cert name check ignore OpenSSL

libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off. libcurl offers two separate and independent options for verifying a server's TLS certificate. CURLOPTSSLVERIFYPEER and CURLOPTSSLVERIFYHOST. T...

CVE-2013-6628

CVE-2013-6628 affects Chromium’s TLS renegotiation handling. OpenSUSE/NASL entries show a fix path in Chromium updates (31.x series) addressing issues where a server’s X.509 certificate could be misinterpreted or not revalidated during TLS renegotiation, potentially impacting trust relationships....

PYSEC-2013-25

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Yafuoku! contains an issue where it fails to verify SSL server certificates

Overview Yafuoku! provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Zachary Mathis of Proactive Defense Kobe Digital Labo reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

python-qpid: client does not validate qpid server TLS/SSL certificate

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

JVN#85812843: FileMaker Pro fails to verify SSL server certificates

FileMaker Pro contains a function to encrypt communications with the FileMaker Server. FileMaker Pro fails to verify the SSL server certificate. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Upgrade the software Upgrade to the latest...

Ubuntu Update for telepathy-idle USN-1821-1

Check for the Version of telepathy-idle OpenVAS Vulnerability Test $Id: gbubuntuUSN18211.nasl 8448 2018-01-17 16:18:06Z teissa $ Ubuntu Update for telepathy-idle USN-1821-1 Authors: System Generated Check Copyright: Copyright c 2013 Greenbone Networks GmbH, http://www.greenbone.net This program i...

Ubuntu 12.04 LTS / 12.10 / 13.04 : telepathy-idle vulnerability (USN-1821-1)

It was discovered that telepathy-idle did not perform any server certificate validation when using SSL connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information. Note that Tenable Network Securit...