CVE-2016-1000033

Shotwell version 0.22.0 and possibly other versions is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks...

U by BB&T iOS banking application fails to properly validate SSL certificates

Overview U by BB&T for iOS, version 1.5.4 and earlier, fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks. Description CWE-295: Improper Certificate Validation - CVE-2016-6550U by BB&T is a banking...

SUSE SLES12 Security Update : squid (SUSE-SU-2016:2008-1)

The Squid HTTP proxy has been updated to version 3.3.14, fixing the following security issues : - Fixed multiple Denial of Service issues in HTTP Response processing. CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc968392, bsc968393, bsc968394, bsc968395 - CVE-2016-3947: Buffer...

DMM Movie Player App for Android and for iPhone/iPad Man-in-the-Middle Attack Vulnerability

DMM Movie Player App is a suite of video player applications from DMM Japan. A security vulnerability exists in DMM Movie Player App for Android before 1.2.1 and for iPhone/iPad before 2.1.3, which originates from the program failing to validate an SSL server-side certificate. An attacker could u...

CVE-2016-4005

The Huawei Hilink App application before 3.19.2 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008...

Cybozu KUNAI App Man-in-the-Middle Attack Vulnerability

Cybozu KUNAI is a set of Cybozu's licensed software applications for quick access to Cybozu's licensed software. A security vulnerability exists in Cybozu KUNAI, which is caused by the program failing to validate SSL server certificates. An attacker could exploit the vulnerability to conduct a...

RHEL 7 : mariadb (RHSA-2016:0534)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:0534 advisory. - mysql: unspecified vulnerability related to Server:Partition CPU October 2015 CVE-2015-4792, CVE-2015-4802 - mysql: unspecified...

HP ArcSight SmartConnector fails to properly validate SSL and contains a hard-coded password

Overview The HP ArcSight SmartConnector fails to properly validate SSL certificates, and also contains a hard-coded password. Description CWE-295: Improper Certificate Validation - CVE-2015-2902The ArcSight SmartConnector fails to validate the certificate of the upstream Logger device it is...

Foreman Man-in-the-Middle Attack Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman versions prior to 1.7.4, which stems from the program's failu...

DEBIAN-CVE-2015-3455

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid...

Apple Safari / Webkit multiple security vulnerabilities

Invalid SSL validation, information leakage, crossite access, memory corruptions...

PT-2015-3734 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.5.4 Foreman versions 1.6.x prior to 1.6.2 Description: The issue allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate, due to the failure ...

Adtrustmedia PrivDog fails to validate SSL certificates

Overview Adtrustmedia PrivDog fails to validate SSL certificates, making systems broadly vulnerable to HTTPS spoofing. Description Adtrustmedia PrivDog is a Windows application that advertises "... safer, faster and more private web browsing." Privdog installs a Man-in-the-Middle MITM proxy as we...

SSL Custom CA Setup

Configure the loading of the certificate authorities for SSL validation. This will load the Tenable-managed default certificate authorities and allow Nessus users to load custom certificate authorities. Multiple custom CA files are available to help with the management of custom certificate...

Prey Anti-Theft for Android missing SSL certificate validation [STIC-2014-0731]

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Fundacion Dr. Manuel Sadosky - Programa STIC Advisory www.fundacionsadosky.org.ar Prey Anti-Theft for Android missing SSL certificate validation 1. Advisory Information Title: Prey Anti-Theft for Android missing SSL certificate validation Advisory ID:...

serf / Apache httpcomponents HttpClient / Jakarta Commons HttpClient SSL validation bypass

Invalid parsing of certificates with NUL character in CN...

Multiple Android applications fail to properly validate SSL certificates

Overview Multiple Android applications fail to properly validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle MITM attack. Description When communicating via HTTPS, an application should validate the SSL chain to be sure that the...

rubygems security update

CentOS Errata and Security Advisory CESA-2013:1441 An updated rubygems package that fixes three security issues is now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS ba...

JVN#75084836: Yahoo! Japan Shopping for Android contains an issue where it fails to verify SSL server certificates

Yahoo! Japan Shopping for Android provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version...

Fedora 19 : python-bugzilla-0.9.0-1.fc19 (2013-11336)

Rebased to version 0.9.0 - bugzilla: modify: add --dependson Don Zickus - bugzilla: new: add --groups option Paul Frields - bugzilla: modify: Allow setting nearly every bug parameter - NovellBugzilla implementation removed, can't get it to work - Gracefully handle private bugs bz 963979 - Raise...