3702 matches found
Mozilla Firefox < 1.7.2 Non-FQDN SSL Certificate Spoofing
Binary data 1771.prm...
RHEL 2.1 : openssl (RHSA-2003:293)
Updated OpenSSL packages are available that fix ASN.1 parsing vulnerabilities. OpenSSL is a commercial-grade, full-featured, and open source toolkit that implements Secure Sockets Layer SSL v2/v3 and Transport Layer Security TLS v1 protocols as well as a full-strength general purpose cryptography...
mozilla -- hostname spoofing bug
When processing URIs that contain an unqualified host name-- specifically, a domain name of only one component-- Mozilla will perform matching against the first component of the domain name in SSL certificates. In other words, in some situations, a certificate issued to "www.example.com" will be...
(RHSA-2003:268) New up2date available with updated SSL certificate authority file
The rhnregister and up2date packages contain the software necessary to take advantage of Red Hat Network functionality. This erratum includes an updated RHNS-CA-CERT file, which contains a new CA certificate. This new certificate is needed so that up2date can continue to communicate with Red Hat...
WebLogic SSL Certificate Chain User Spoofing
The remote web server is running WebLogic. There is a bug in this version that could allow an attacker to perform a man-in-the-middle attack against the remote server by supplying a self-signed certificate. An attacker with a legitimate certificate could use this flaw to impersonate any other use...
SSL certificate validation problems in Ximian Evolution
Discovered: 2002-09-08, Ximian has been informed on 2002-09-09. Impact: medium, if SSL IMAPS, SMTPS, POP3S used none, if not Affected: Ximian Evolution 1.0.x and earlier Description: Due to missing SSL validation code, Evolution's camel component is vulnerable to common SSL man-in-the-middle...
DSA-155 kdelibs - privacy escalation with Konqueror
Bulletin has no description...
CVE-2001-1569
Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities, which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack...
IE fails to check certificates properly if initial SSL connection originates in an IFRAME or Image
Overview Several flaws exist in Microsoft Internet Explorer that could allow an attacker to masquerade as a legitimate web site if the attacker can compromise the validity of certain DNS information. These problems are different from the problems reported in CERT Advisory CA-2000-05 and CERT...
CVE-2000-0519
CVE-2000-0519 affects Internet Explorer 4.x/5.x. The vulnerability arises because SSL certificates are not properly re-validated when a user starts a new SSL session with the same server within the same IE session, giving partial confidentiality impact. The CVSS v2 base score is 2.6 (LOW). No rem...
CVE-2000-0518
Internet Explorer 4.x and 5.x does not properly verify all contents of an SSL certificate if a connection is made to the server via an image or a frame, aka one of two different "SSL Certificate Validation" vulnerabilities...
CVE-2000-0518
This CVE concerns Internet Explorer 4.x/5.x where SSL certificate validation is incomplete when the connection is initiated via an image or an iframe. The underlying issue is that IE verifies only that the certificate was issued by a trusted root, but does not confirm the server name or the certi...
CVE-2000-0519
Internet Explorer 4.x and 5.x does not properly re-validate an SSL certificate if the user establishes a new SSL session with the same server during the same Internet Explorer session, aka one of two different "SSL Certificate Validation" vulnerabilities...
CVE-2000-0406
Netscape Communicator before version 4.73 and Navigator 4.07 do not properly validate SSL certificates, which allows remote attackers to steal information by redirecting traffic from a legitimate web server to their own malicious server, aka the "Acros-Suencksen SSL" vulnerability...
Security Bulletin (MS00-039)
Microsoft Security Bulletin MS00-039 - -------------------------------------- Patch Available for "SSL Certificate Validation" Vulnerabilities Originally posted: June 05, 2000 Summary ======= Microsoft has released a patch that eliminates two security vulnerabilities in Microsoftr Internet...
CVE-2000-0519
Internet Explorer 4.x and 5.x does not properly re-validate an SSL certificate if the user establishes a new SSL session with the same server during the same Internet Explorer session, aka one of two different "SSL Certificate Validation" vulnerabilities...
CVE-2000-0518
Internet Explorer 4.x and 5.x does not properly verify all contents of an SSL certificate if a connection is made to the server via an image or a frame, aka one of two different "SSL Certificate Validation" vulnerabilities...
Advisory CA-2000-05
-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2000-05 Netscape Navigator Improperly Validates SSL Sessions Original release date: May 12, 2000 Source: ACROS, CERT/CC A complete revision history is at the end of this file. Systems Affected Systems running Netscape Navigator 4.72, 4.61, and...
CVE-2000-0406
Netscape Communicator before version 4.73 and Navigator 4.07 do not properly validate SSL certificates, which allows remote attackers to steal information by redirecting traffic from a legitimate web server to their own malicious server, aka the "Acros-Suencksen SSL" vulnerability...
DUO-PSA-2020-004: Duo Product Security Advisory
Duo Product Security Advisory Advisory ID: DUO-PSA-2020-004 CVE: CVE-2020-3483 Publication Date: 2020-08-13 Revision Date: 2020-08-13 Status: Confirmed, Fixed Document Revision: 1 Overview Duo has identified and fixed an issue with the Duo Network Gateway DNG product in which some customer-provid...