453 matches found
CVE-2014-4749
IBM PowerVC 1.2.0 before FixPack3 does not properly use the knownhosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key...
Code injection
IBM PowerVC 1.2.0 before FixPack3 does not properly use the knownhosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key...
CVE-2014-3522
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate...
CVE-2014-3504
CVE-2014-3504 (Serf) affects the Serf SSL certificate handling in Serf 0.2.0–1.3.x prior to 1.3.7, where a NUL byte in a domain name within the certificate’s subject CN could allow a remote attacker to spoof an SSL server (MITM). The issue stems from improper parsing/validation of CN in X.509 cer...
CVE-2014-3522
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate...
PT-2014-1443
Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.7.x before 1.7.18 Apache Subversion versions 1.8.x before 1.8.10 Description The issue exists due to incorrect handling of wildcards in the Common Name CN or subjectAltName field of the X.509...
DLA-25-3 python2.6 - regression update
Bulletin has no description...
OpenSSH 1.2 scp File Create/Overwrite Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/1742/info A vulnerability exists in the 1.2.x releases of scp which, if properly exploited using a modified scp binary on the server end, can permit the remote server to spoof local pathnames and overwrite files belonging...
PT-2014-2351
Name of the Vulnerable Software and Affected Versions x3270 versions prior to 3.3.12ga12 Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because it does not verify that the server hostname matches a domain name in the subject's Comm...
CVE-2013-0289: Undefined Security Weakness
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
PT-2014-3118
Name of the Vulnerable Software and Affected Versions PyWBEM versions 0.7 and earlier Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because it does not verify that the server hostname matches a domain name in the subject's Common...
CVE-2013-6444: Improper Input Validation
PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
PT-2014-3580
Name of the Vulnerable Software and Affected Versions POCO C++ Libraries versions prior to 1.4.6p4 Description The issue allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509...
PT-2014-4953
Name of the Vulnerable Software and Affected Versions wolfSSL CyaSSL versions prior to 2.9.4 Description The issue is related to the improper validation of X.509 certificates with unknown critical extensions. This allows man-in-the-middle attackers to spoof servers via crafted X.509 certificates...
KLA10396 SB vulnerability in WinSCP
A lack of hostname verifications was found in the WinSCP. By exploiting this vulnerability malicious users can spoof the SSL server. This vulnerability can be exploited remotely via a man-in-the-middle attack. Original advisories - Related products WinSCP CVE list CVE-2014-2735 high Solution Upda...
PT-2014-4892
Name of the Vulnerable Software and Affected Versions WinSCP versions prior to 5.5.3 Description The issue arises when using FTP with TLS, as it fails to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. This...
CVE-2014-0636
EMC RSA BSAFE Micro Edition Suite MES 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain...
CVE-2014-1492
The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...
CVE-2014-1492
The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...