Social App does not validate server certificates for outgoing connections (NC-SA-2020-043)

Missing validation of server certificates for out-going connections allowed a man-in-the-middle attack...

openSUSE: Security Advisory for tigervnc (openSUSE-SU-2020:1666-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:1666-1 Security update for tigervnc

This update for tigervnc fixes the following issues: - CVE-2020-26117: Server certificates were stored as certiticate authorities, allowing malicious owners of these certificates to impersonate any server after a client had added an exception bsc1176733 This update was imported from the...

USN-4453-1 openjdk-8 vulnerabilities

Johannes Kuhn discovered that OpenJDK 8 incorrectly handled access control contexts. An attacker could possibly use this issue to execute arbitrary code. CVE-2020-14556 Philippe Arteau discovered that OpenJDK 8 incorrectly verified names in TLS server's X.509 certificates. An attacker could...

OPENSUSE-SU-2020:0222-1 Security update for hostapd

This update for hostapd fixes the following issues: hostapd was updated to version 2.9: SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks https://w1.fi/security/2019-6/ EAP-pwd changes - disable use of groups using Brainpool curves -...

Dell Foundation Services installs root certificate and private key (eDellRoot)

Dell Foundation Services installs the eDellRoot certificate into theTrusted Root Certificate Store on Microsoft Windows systems. The certificate includes the private key. This allows attackers to create trusted certificates and perform impersonation, man-in-the-middle MiTM, and passive decryption...

CVE-2020-5520

The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Huawei EulerOS: Security Advisory for freerdp (EulerOS-SA-2019-2455)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Android App "NTV News24" fails to verify SSL server certificates

Overview Android App "NTV News24" provided by Nippon Television Network Corporation fails to verify SSL server certificates CWE-295. Shinnosuke Tokusho of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported this vulnerability to IPA...

EulerOS 2.0 SP3 : freerdp (EulerOS-SA-2019-2580)

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted serve...

EulerOS 2.0 SP2 : freerdp (EulerOS-SA-2019-2455)

According to the versions of the freerdp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service NULL pointer dereference and application crash by...

New Requirements for trusted certificates in iOS 13+/iOS 14+ and macOS 10.15.x/11.x

Apple has new requirements for TLS server certificates in iOS/iPadOS 13, iOS/iPadOS 14, macOS 10.15.x and macOS 11.x. Verify that all certificates follow the Apple requirements. For more details,review the following articles from Apple directly: https://support.apple.com/en-us/HT210176...

The vulnerability of the SSL traffic decryption function of Cisco Web Security Appliance lies in insufficient verification of server Secure Sockets Layer certificates. This allows attackers to trigger a service failure.

The vulnerability of the SSL traffic decryption function in Cisco Web Security Appliance relates to insufficient verification of Secure Sockets Layer server certificates. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by installing incorrectly generated...

CVE-2019-1886 Cisco Web Security Appliance HTTPS Certificate Denial of Service Vulnerability

A vulnerability in the HTTPS decryption feature of Cisco Web Security Appliance WSA could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to insufficient validation of Secure Sockets Layer SSL server certificates. An attacker could...

Man-in-the-Middle

Mozilla Firefox, Firefox ESR and Thunderbird are vulnerable to man-in-the-middle attacks. A remote attacker can spoof add-on updates and obtain confidential information via leveraging possession of X.509 server certificates...

CVE-2019-8351

Heimdal Thor Agent 2.5.17x before 2.5.173 does not verify X.509 certificates from TLS servers, which allows remote attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2019-1683 Cisco SPA112, SPA525, and SPA5x5 Series IP Phones Certificate Validation Vulnerability

A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security TLS-encrypted Session Initiation Protocol SIP conversation. The...

CVE-2018-16187

The RICOH Interactive Whiteboard D2200 V1.3 to V2.2, D5500 V1.3 to V2.2, D5510 V1.3 to V2.2, the display versions with RICOH Interactive Whiteboard Controller Type1 V1.3 to V2.2 attached D5520, D6500, D6510, D7500, D8400, and the display versions with RICOH Interactive Whiteboard Controller Type2...

CVE-2018-16179

The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...