CVE-2017-5919: Improper Certificate Validation

The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2017-16748

Name of the Vulnerable Software and Affected Versions Great Southern Mobile Banking app version prior to 4.0.4 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the app does not verify X.509 certificates from S...

PT-2017-16758

Name of the Vulnerable Software and Affected Versions Banco de Costa Rica BCR Movil app version 3.7 for iOS Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the app does not verify X.509 certificates from SSL...

PT-2017-16754

Name of the Vulnerable Software and Affected Versions DOT IT Banque Zitouna app version 2.1 for iOS Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the app does not verify X.509 certificates from SSL...

CVE-2016-4467

The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate when using the SChannel-based security layer,...

PT-2017-15172

Name of the Vulnerable Software and Affected Versions TVer App for Android versions 3.2.7 and earlier Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the TVer App for Android does not verify X.509...

Apple iOS webkit bookmark forgery vulnerability

Apple iOS is an operating system for Apple smart devices. The creation of bookmarks in Webkit used by Apple iOS suffers from authentication forgery, which allows an attacker to construct malicious links and trick users into clicking on them, which could spoof bookmarks or execute arbitrary code...

CVE-2017-5046

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure...

CVE-2017-5046

Removed by vendor...

PT-2017-7961

Name of the Vulnerable Software and Affected Versions Grandstream Wave app versions 1.0.1.26 and earlier Grandstream Video IP phones versions affected versions not specified Description The issue concerns the auto-provisioning mechanism, which fails to use an HTTPS session for downloading...

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

CVE-2017-5653

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

CVE-2017-6059

Modauthopenidc.c in the Ping Identity OpenID Connect authentication module for Apache aka modauthopenidc before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request...

CVE-2017-6059

Modauthopenidc.c in the Ping Identity OpenID Connect authentication module for Apache aka modauthopenidc before 2.14 allows remote attackers to spoof page content via a malicious URL provided to the user, which triggers an invalid request...

VMware vSphere Data Protection (VDP) Man-in-the-Middle Attack Vulnerability

VMware vSphere Data Protection VDP is prone to a man in the middle attack vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

KLA11024 Defense-in-Depth Update for Microsoft Office

An unspecified vulnerability was found in the EPS Encapsulated PostScript filter in Microsoft Office. By exploiting this vulnerability malicious users can possibly execute arbitrary code. This vulnerability can be exploited remotely via a specially designed website or file. NB: This vulnerability...

CVE-2017-2378

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

CVE-2017-2378

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves bookmark creation in the "WebKit" component. It allows remote attackers to execute arbitrary code or spoof a bookmark by leveraging mishandling of links during...

PT-2017-1755

Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.3 Safari versions prior to 10.1 Description The issue involves the Safari component and allows remote attackers to spoof an HTTP authentication sheet or cause a denial of service via a crafted web site. It is related t...