CVE-2011-4092

obby aka libobby does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate...

CVE-2011-4092

CVE-2011-4092 affects obby (aka libobby), where SSL server certificates are not verified. This allows remote attackers to spoof servers by presenting an arbitrary certificate. The connected sources reiterate that the underlying issue is the lack of server certificate verification, with no documen...

PT-2014-2159

Name of the Vulnerable Software and Affected Versions obby aka libobby affected versions not specified Description The issue is related to the lack of verification of SSL server certificates, allowing remote attackers to spoof servers by using an arbitrary certificate. Recommendations At the...

PT-2014-2336

Name of the Vulnerable Software and Affected Versions Gajim versions prior to 0.15.3 Description The issue allows remote attackers to conduct man-in-the-middle MITM attacks and spoof servers via an arbitrary certificate from a trusted CA, due to improper verification of SSL certificates by the ss...

CVE-2013-7304: Undefined Security Weakness

Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices, which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client...

CVE-2013-2037

CVE-2013-2037 affects the Python HTTP client library httplib2 versions up to 0.7.2/0.8 and earlier. Root cause: after the initial connection, the client does not verify that the server hostname matches the CN or subjectAltName in the server's X.509 certificate, enabling MITM via an arbitrary vali...

PT-2014-2487

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services NSS versions prior to 3.15.4 Description The issue allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic when the TLS False Start...

CVE-2013-1740

The sslDo1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services NSS before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic...

PYSEC-2013-45

keystone/middleware/authtoken.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova...

Moderate: Red Hat Security Advisory: Red Hat JBoss Operations Network 3.2.0 update

Red Hat JBoss Operations Network 3.2.0, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, whi...

CVE-2013-4545: Undefined Security Weakness

cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification CURLOPTSSLVERIFYHOST when the digital signature verification CURLOPTSSLVERIFYPEER is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrar...

CVE-2013-4314

The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

CVE-2012-4073

The KVM subsystem in the client in Cisco Unified Computing System UCS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers, and read or modify KVM data, via a crafted certificate, aka Bug ID CSCte90332...

CVE-2012-6087

repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2013-4314

The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

Design/Logic Flaw

The opensslx509parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL...

PT-2014-2531

Name of the Vulnerable Software and Affected Versions httplib2 versions 0.7.2 and earlier httplib2 versions 0.8 and earlier httplib2 versions prior to 0.10.1 Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because, after an initial...

Oracle Linux 5 : axis (ELSA-2013-0683)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0683 advisory. - Resolves: CVE-2012-5784 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not teste...

MGASA-2013-0199 Updated jakarta-commons-httpclient package fixes security vulnerability

The Jakarta Commons HttpClient component did not verify that the server hostname matched the domain name in the subject's Common Name CN or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for...

PT-2013-4766

Name of the Vulnerable Software and Affected Versions Juniper Junos Pulse Secure Access Service aka SSL VPN versions 7.0r2 through 7.0r8 Juniper Junos Pulse Secure Access Service aka SSL VPN versions 7.1r1 through 7.1r5 Juniper Junos Pulse Access Control Service aka UAC versions 4.1r1 through 4.1...