CVE-2012-4829: Undefined Security Weakness

IBM XIV Storage System Gen3 before 11.2 relies on a default X.509 v3 certificate for authentication, which allows man-in-the-middle attackers to spoof servers by leveraging an inappropriate certificate-trust relationship...

Code injection

Microsoft Windows Modern Mail allows remote attackers to spoof link targets via a crafted HTML e-mail message...

CVE-2013-1299

CVE-2013-1299 affects Microsoft Windows Modern Mail. The vulnerability allows remote attackers to spoof link targets in crafted HTML e-mails due to improper handling of link targets, enabling phishing-like deception. Affected component is Windows Modern Mail; underlying cause is spoofable link ta...

CVE-2013-2279: Improper Input Validation

CA SiteMinder Federation FSS 12.5, 12.0, and r6; Federation Standalone 12.1 and 12.0; Agent for SharePoint 2010; and SiteMinder for Secure Proxy Server 6.0, 12.0, and 12.5 does not properly verify XML signatures for SAML statements, which allows remote attackers to spoof other users and gain...

CVE-2013-2503

Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 aka Proxy Authentication Required HTTP status code...

CVE-2013-0308

The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2011-4318

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name CN of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers...

Code injection

The Cisco Network Admission Control NAC agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine ISE server during an SSL session, which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate, aka Bug ID CSCub24309...

Nmap NSE 6.01: auth-spoof

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-4694

Moxa EDR-G903 series routers with firmware before 2.11 do not use a sufficient source of entropy for 1 SSH and 2 SSL keys, which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation...

Fedora 17 : axis-1.4-19.fc17 (2013-1194)

This update fixes a security vulnerability that caused axis not to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid...

Fedora 16 : jakarta-commons-httpclient-3.1-12.fc16 (2013-1289)

This update fixes a security vulnerability that caused jakarta-commons-httpclient not to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via...

Fedora 18 : axis-1.4-19.fc18 (2013-1222)

This update fixes a security vulnerability that caused axis not to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allowed man-in-the-middle attackers to spoof SSL servers via andaarbitrary valid...

CVE-2012-5484

The CVE-2012-5484 issue affects FreeIPA 2.x and 3.x prior to 3.1.2 where the client fails to correctly obtain the CA certificate from the server, enabling a man-in-the-middle during the join procedure via a crafted certificate. Connected advisories indicate mitigations implemented in IPA client u...

CVE-2012-5484: Undefined Security Weakness

The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority CA certificate from the server, which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate...

pyrad -- multiple vulnerabilities

Nathaniel McCallum reports: packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack. The CreateID function in packet.py in pyrad before 2.1 uses...

CVE-2012-6471: Undefined Security Weakness

Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests...

PT-2012-6296 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 3.5.5 Description: The issue concerns the netlink sendmsg function in the Linux kernel, which fails to validate the dst pid field. This allows local users to potentially spoof Netlink messages, although the exac...

PT-2012-2830

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Enterprise versions prior to 8.6.0.2 IBM Rational Policy Tester versions prior to 8.5.0.3 Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate because X.509 certificate...

PT-2012-6087

Name of the Vulnerable Software and Affected Versions IBM WebSphere DataPower XC10 Appliance versions 2.0.0.0 through 2.0.0.3 IBM WebSphere DataPower XC10 Appliance versions 2.1.0.0 through 2.1.0.2 Description The issue allows remote attackers to spoof a container server by either sniffing the...