CVE-2019-3890

CVE-2019-3890 affects evolution-ews in Evolution Data Server (before 3.31.3). The flaw: SSL certificate validity is not checked, enabling an attacker to trick users into connecting to a fake server and obtain confidential information. Multiple Nessus entries reference this CVE within various Linu...

CVE-2019-14334

An issue was discovered on D-Link 6600-AP, DWL-3600AP, and DWL-8610AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated Certificate and RSA Private Key extraction through an insecure sslcert-get.cgi HTTP command...

CVE-2019-14399

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

CVE-2019-14399

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

CVE-2019-14394

cPanel before 80.0.5 allows unsafe file operations in the context of the root account via the fetchsslcertificatesforfqdns API SEC-489...

Design/Logic Flaw

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

CVE-2019-14399

The CVE-2019-14399 affects cPanel’s SSL certificate-storage feature prior to version 78.0.18, allowing unsafe file operations in the root context (SEC-477). The root-privilege impact is indicated by the CVSS data (high for CVSS3, medium for CVSS2). The available connected sources confirm the prod...

CVE-2019-14399

The SSL certificate-storage feature in cPanel before 78.0.18 allows unsafe file operations in the context of the root account SEC-477...

INSIDE Secure MatrixSSL Buffer Overflow Vulnerability (CNVD-2020-22363)

INSIDE Secure MatrixSSL is an embedded, open source SSLv3 stack from INSIDE Secure, France, designed for small applications and devices. INSIDE Secure MatrixSSL suffers from a buffer overflow vulnerability that stems from the DTLS server not properly handling incoming network messages. An attacke...

PT-2019-3138 · Openssl +1 · Openssl +1

Name of the Vulnerable Software and Affected Versions: OpenSSL versions 1.0.2 through 1.0.2s OpenSSL versions 1.1.0 through 1.1.0k OpenSSL versions 1.1.1 through 1.1.1c Description: The issue is related to errors in the certificate authentication procedure. It allows an attacker to impact data...

thunderbird security and bug fix update

60.8.0-1.0.1 60.8.0-1 - Updated to 60.8.0 60.7.2-3 - Rebuild to fix rhbz1725919 - Thunderbird fails to authenticate with gmail with ssl/tls and OAuth2...

Unique Monokle Android Spyware Self-Signs Certificates

A never-before-publicized mobile spy tool, a mobile surveillanceware remote access trojan RAT for Android called Monokle, has been spotted using novel techniques to exfiltrate data. According to the Lookout researchers who discovered Monokle in the wild, the malware has the ability to self-sign...

Palo Alto Networks GlobalProtect SSL VPN Remote Code Execution (CVE-2019-1579)

A Remote Code Execution vulnerability exists in Palo Alto Networks GlobalProtect SSL VPN Gateway. An unauthenticated attacker could exploit the vulnerability by sending a specially crafted request to a vulnerable SSL VPN target. Successful exploitation of this vulnerability would allow remote...

thunderbird security update

60.8.0-1.0.1 - Replaced thunderbird-redhat-default-prefs.js with thunderbird-oracle-default-prefs.js 60.8.0-1 - Updated to 60.8.0 60.7.2-3 - Rebuild to fix rhbz1725919 - Thunderbird fails to authenticate with gmail with ssl/tls and OAuth2...

CVE-2019-1010206

OSS Http Request Apache Cordova Plugin 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing...

CVE-2019-1010206

OSS Http Request Apache Cordova Plugin 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing...

Design/Logic Flaw

OSS Http Request Apache Cordova Plugin 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing...

CVE-2019-1010206

CVE-2019-1010206 affects OSS Http Request (Apache Cordova Plugin) 6. The root cause is missing SSL certificate validation in the library used for HTTPS communication, enabling certificate spoofing. Documented impact is partial integrity loss and potential confidentiality risk via MITM-like behavi...

CVE-2019-1010206

OSS Http Request Apache Cordova Plugin 6 is affected by: Missing SSL certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing...

Critical RCE Flaw in Palo Alto Gateways Hits Uber

A remote code-execution RCE vulnerability has been uncovered in the GlobalProtect portal and GlobalProtect Gateway interface security products from Palo Alto Networks. It’s an unusual zero-day case, having been previously unknown but inadvertently fixed in later releases — but some large companie...