545 matches found
Palo Alto Networks GlobalProtect certificate spoofing
Server certificate is no checked...
Scientific Linux Security Update : ruby on SL5.x, SL4.x i386/x86_64
A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. CVE-2006-6303 An SSL certificate validation flaw w...
mutt-devel -- failure to check SMTP TLS server certificate
Dave B reports on Full Disclosure: It seems that mutt fails to check the validity of a SMTP servers certificate during a TLS connection. ... This means that an attacker could potentially MITM a mutt user connecting to their SMTP server even when the user has forced a TLS connection...
Ubuntu Update for python-httplib2 USN-1375-1
Ubuntu Update for Linux kernel vulnerabilities USN-1375-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN13751.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for python-httplib2 USN-1375-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH,...
Ubuntu: Security Advisory (USN-1375-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 11.10 : ubuntuone-couch vulnerability (USN-1381-1)
It was discovered that Ubuntu One Couch did not perform any server certificate validation when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information. Note that Tenable Network...
Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : python-httplib2 vulnerability (USN-1375-1)
The httplib2 Python library earlier than version 0.7.0 did not perform any server certificate validation when using HTTPS connections. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to alter or compromise confidential information in applications...
tigervnc: vncviewer can send password to server without proper validation of the X.509 certificate
The CSecurityTLS::processMsg function in common/rfb/CSecurityTLS.cxx in the vncviewer component in TigerVNC 1.1beta1 does not properly verify the server's X.509 certificate, which allows man-in-the-middle attackers to spoof a TLS VNC server via an arbitrary certificate...
Linux/x86-32 - ConnectBack with SSL connection - 422 bytes
Linux/x86-32 - ConnectBack with SSL connection - 422 bytes. Shellcode exploit for linux platform / Title: Linux/x86-32 - ConnectBack with SSL connection - 422 bytes Date: 2011-06-08 Tested on: ArchLinux i686 Author: Jonathan Salwan - twitter: @jonathansalwan http://shell-storm.org Configurations...
weechat certificate spoofing
Server certificate is not validated...
CVE-2010-3901
OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...
Design/Logic Flaw
Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificat...
Design/Logic Flaw
OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that 1 does not correspond to the server hostname or 2 is presented in circumstances involving a missing...
CVE-2010-3900
Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312...
CVE-2010-3900
Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312...
openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2010:0198-2)
Updated mysql packages fix the following bugs : - upstream 47320 - checking server certificates CVE-2009-4028 - upstream 48291 - error handling in subqueries CVE-2009-4019 - upstream 47780 - preserving nullvalue flag in GeomFromWKB CVE-2009-4019 - upstream 39277 - symlink behaviour fixed...
MySQL OpenSSL客户端绕过yaSSL服务器证书验证漏洞
BUGTRAQ ID: 37076 CVE ID: CVE-2009-4028 MySQL是一款使用非常广泛的开放源代码关系数据库系统，拥有各种平台的运行版本。 在使用OpenSSL的时候，MySQL的viosslfactories.c文件中的vioverifycallback函数可以接受深度为0的X.509证书： vioverifycallback at viosslfactories.c: / Approve cert if depth is greater then "verifydepth", currently verifydepth is always 0 and there...
OpenSSL: DTLS pointer use-after-free flaw (DoS)
Use-after-free vulnerability in the dtls1retrievebufferedfragment function in ssl/d1both.c in OpenSSL 1.0.0 Beta 2 allows remote attackers to cause a denial of service openssl sclient crash and possibly have unspecified other impact via a DTLS packet, as demonstrated by a packet from a server tha...
USN-792-1: OpenSSL vulnerabilities
It was discovered that OpenSSL did not limit the number of DTLS records it would buffer when they arrived with a future epoch. A remote attacker could cause a denial of service via memory resource consumption by sending a large number of crafted requests. CVE-2009-1377 It was discovered that...