Hardcoded credentials

Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a 1 4xx or 2 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL...

Design/Logic Flaw

The dtls1bufferrecord function in ssl/d1pkt.c in OpenSSL 0.9.8k and earlier 0.9.8 versions allows remote attackers to cause a denial of service memory consumption via a large series of "future epoch" DTLS records that are buffered in a queue, aka "DTLS record buffer limitation bug."...

CVE-2009-1522

The IBM Tivoli Storage Manager TSM client 5.5.0.0 through 5.5.1.17 on AIX and Windows, when SSL is used, allows remote attackers to conduct unspecified man-in-the-middle attacks and read arbitrary files via unknown vectors...

Mandriva Update for ruby MDVSA-2008:029 (ruby)

Check for the Version of ruby OpenVAS Vulnerability Test Mandriva Update for ruby MDVSA-2008:029 ruby Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the ter...

Design/Logic Flaw

Sun Java System Identity Manager IdM 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to "ssl termination devices" and lack of support for relative URLs...

CVE-2007-6263

The dataconn function in ftpd.c in netkit ftpd netkit-ftpd 0.17, when certain modifications to support SSL have been introduced, calls fclose on an uninitialized file stream, which allows remote attackers to cause a denial of service daemon crash and possibly have unspecified other impact via som...

CVE-2007-5770

The 1 Net::ftptls, 2 Net::telnets, 3 Net::imap, 4 Net::pop, and 5 Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName CN field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL...

Code injection

Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a man-in-the-middle MITM attack...

CVE-2007-3754

Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a man-in-the-middle MITM attack...

CVE-2005-3357

CVE-2005-3357 affects mod_ssl in Apache 2.0 up to 2.0.55; when using an SSL vhost with access control and a custom 400 error page, a non-SSL request to an SSL port can trigger a NULL pointer dereference, causing a denial of service. Remediation/version is not specified in the provided documents.

Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted SSL Attack

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ================================================================= Cisco Security Advisory: Cisco VPN 3000 Concentrator Vulnerable to Crafted SSL attack ================================================================= Revision 1.0 For Public Release...

telnetd-ssl format string bug

No description provided...

[SECURITY] [DSA 616-1] New telnetd-ssl packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 616-1 [email protected] http://www.debian.org/security/ Martin Schulze December 23rd, 2004 http://www.debian.org/security/faq -...

[SECURITY] [DSA 616-1] New telnetd-ssl packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 616-1 [email protected] http://www.debian.org/security/ Martin Schulze December 23rd, 2004 http://www.debian.org/security/faq -...

CVE-2004-0998

Format string vulnerability in telnetd-ssl 0.17 and earlier allows remote attackers to execute arbitrary code...

CVE-2004-0612

The Mobile Code filter in ZoneAlarm Pro 5.0.590.015 does not filter mobile code within an SSL encrypted session, which could allow remote attackers to bypass the mobile code filtering. NOTE: it has been disputed by the vendor that this behavior is required by the SSL specification...

Fedora Core 2 : httpd-2.0.51-2.9 (2004-420)

Thu Nov 11 2004 Joe Orton 2.0.51-2.9 - add fix for memory consumption DoS, CVE-2004-0942 - modssl: add fix for SSLCipherSuite bypass, CVE-2004-0885 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to...

FreeBSD : apache2 -- SSL remote DoS (16)

The following package needs to be updated: apache %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg7b81fc47239f11d9814e0001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright...

[SECURITY] [DSA 569-1] New netkit-telnet-ssl packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 569-1 [email protected] http://www.debian.org/security/ Martin Schulze October 18th, 2004 http://www.debian.org/security/faq -...

Debian DSA-247-1 : courier-ssl - missing input sanitizing

The developers of courier, an integrated user side mail server, discovered a problem in the PostgreSQL auth module. Not all potentially malicious characters were sanitized before the username was passed to the PostgreSQL engine. An attacker could inject arbitrary SQL commands and queries exploiti...