CVE-2014-0104: Improper Certificate Validation

In fence-agents before 4.0.17 does not verify remote SSL certificates in the fenceciscoucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates...

CVE-2014-0072: Improper Input Validation

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin org.apache.cordova.file-transfer before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the...

PT-2016-6629

Name of the Vulnerable Software and Affected Versions Intel Crosswalk versions prior to 19.49.514.5 Intel Crosswalk versions 20.x prior to 20.50.533.11 Intel Crosswalk versions 21.x prior to 21.51.546.0 Intel Crosswalk versions 22.x prior to 22.51.549.0 Description The issue allows...

CVE-2012-5583

phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2014-0350

The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate...

PT-2014-3731

Name of the Vulnerable Software and Affected Versions EMC RSA BSAFE Micro Edition Suite MES versions 3.2.x through 3.2.5 EMC RSA BSAFE Micro Edition Suite MES versions 4.0.x through 4.0.4 Description The issue is related to the improper validation of X.509 certificate chains, which allows...

CVE-2014-1210: Undefined Security Weakness

VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate...

CVE-2014-0636: Undefined Security Weakness

EMC RSA BSAFE Micro Edition Suite MES 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain...

Ubuntu Update for nss USN-2159-1

Check for the Version of nss OpenVAS Vulnerability Test $Id: gbubuntuUSN21591.nasl 7957 2017-12-01 06:40:08Z santu $ Ubuntu Update for nss USN-2159-1 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you ca...

CVE-2014-1492: Improper Input Validation

The certTestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services NSS before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof...

PT-2014-1455

Name of the Vulnerable Software and Affected Versions Mozilla Network Security Services NSS versions prior to 3.16 Description The issue exists in the cert TestHostName function in lib/certdb/certdb.c, which is part of the certificate-checking implementation. This function accepts a wildcard...

PT-2014-3233

Name of the Vulnerable Software and Affected Versions Belkin WeMo Home Automation firmware versions prior to 3949 Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary X.509 certificate, as the firmware does not maintain a set of Certification Authority...

Updated nss packages fix security vulnerability

Updated nss packages fix security vulnerability: The sslDo1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services NSS before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509...

Fedora 17 : ruby-1.9.3.448-31.fc17 (2013-12062)

A vulnerability was found in Ruby's SSL client that could allow man-in-the-middle attackers to spoof SSL servers via valid certificate issued by a trusted certification authority. This vulnerability has been assigned the CVE identifier CVE-2013-4073. This new update should solve this issue. Note...

PT-2013-4058

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Optim Data Growth for Oracle E-Business Suite versions 6.x through 9.x before 9.1.0.3 Description The issue is related to the use of the MD5 algorithm for signatures in X.509 certificates, which can be exploited by...

CVE-2013-2953: Undefined Security Weakness

IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x, 7.x, and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate...

CVE-2007-6746: Improper Input Validation

telepathy-idle before 0.1.15 does not verify 1 that the issuer is a trusted CA, 2 that the server hostname matches a domain name in the subject's Common Name CN, or 3 the expiration date of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid...

PT-2012-2830

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions prior to 8.6.0.2 IBM Rational Policy Tester versions prior to 8.5.0.3 Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate because X.509 certificate...

CVE-2011-5241: Improper Input Validation

ServicesTwitter 0.6.3 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-5780: Improper Input Validation

The Amazon merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...