22 matches found
MUT-BC-SS-01
MUT-BC-SS-01: Mutation Testing of X.509 BasicConstraints in OpenSSL Overview This repository implements a specification-driven mutation testing experiment targeting X.509 certificate validation behavior in OpenSSL. The experiment is based on the mutation operator: MUT-BC-SS-01 which modifies the...
MikroTik RouterOS 7.0.x < 7.23.4 / 7.24.x < 7.24.2 X.509 Signature Validation Bypass (CVE-2026-67278)
According to its self-reported version, the remote networking device is running a version of MikroTik RouterOS 7.0.x prior to 7.23.4, or 7.24.x prior to 7.24.2. It is, therefore, affected by a certificate validation vulnerability. MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures duri...
CVE-2026-67278
MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...
EUVD-2026-72026
MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use the root’s public certificate - without its private key - to forge a trusted...
CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS
MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...
CVE-2026-67278 TLS server impersonation possible in Mikrotik RouterOS
MikroTik RouterOS accepts malformed RSA/PKCS1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an outbound RouterOS TLS connection can use...
CVE-2026-67278
MikroTik RouterOS (7.x branch) is vulnerable to a cryptographic signature verification flaw where it accepts malformed RSA/PKCS#1 v1.5 signatures. Because the trust store includes an e=3 root CA , an attacker who can redirect outbound TLS connections can use the root's public certificate to forge...
PT-2026-85023
In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFilter parses an X.509 certificate that the client sends inside the MQTT message payload the authentication field of MqttRequestTemplate and treats its Subject...
PT-2026-86453
Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 6.49.21 MikroTik RouterOS versions prior to 7.23.4 MikroTik RouterOS versions prior to 7.24.2 Description RouterOS accepts malformed RSA/PKCS1 v1.5 signatures during X.509 validation. Due to the inclusion of...
AZL-94202 CVE-2026-59251 affecting package erlang for versions less than 26.2.5.21-4
Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...
CVE-2026-59251
Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...
AZL-81180 CVE-2026-32884 affecting package botan2 2.14.0-2
Botan is a C++ cryptography library. Prior to version 3.11.0, during processing of an X.509 certificate path using name constraints which restrict the set of allowable DNS names, if no subject alternative name is defined in the end-entity certificate Botan would check that the CN was allowed by t...
[SECURITY] [DLA 3284-1] libapache-session-ldap-perl security update
Debian LTS Advisory DLA-3284-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin January 28, 2023 https://wiki.debian.org/LTS Package : libapache-session-ldap-perl Version : 0.4-1+deb10u1 CVE ID : CVE-2020-36658 In Apache::Session::LDAP before 0.5, validity of the...
MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates
I happened to notice that a public X.509 certificate testcase for CVE-2014-1569 caused a stack buffer overflow in MatrixSSL. I cleaned up the testcase a bit, to make a better demonstration. You can test it with the certValidate tool that comes with MatrixSSL. $ gdb -q --args...
Polycom VVX 500 / VVX 601 5.8.0.12848 Man-In-The-Middle Vulnerability
Exploit for hardware platform in category local exploits Polycom VVX 500 / VVX 601 5.8.0.12848 Man-In-The-Middle Vulnerability Product: VVX 500 / VVX 601 Manufacturer: Polycom Affected Versions: = 5.8.0.12848 Tested Versions: 5.4.0.10182, 5.8.0.12848 Vulnerability Type: X.509 validation -...
AudioCodes 440HD / 450HD IP Phone 3.1.2.89 Man-In-The-Middle Vulnerability
Exploit for hardware platform in category local exploits AudioCodes 440HD / 450HD IP Phone 3.1.2.89 Man-In-The-Middle Vulnerability Product: 440HD / 450HD IP Phone Manufacturer: AudioCodes Affected Versions: = 3.1.2.89 Tested Versions: VC3.1.1.43.1, VC3.1.2.89 Vulnerability Type: X.509 validation...
Polycom VVX 500 / VVX 601 5.8.0.12848 Man-In-The-Middle
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2018-027 Product: VVX 500 / VVX 601 Manufacturer: Polycom Affected Versions: = 5.8.0.12848 Tested Versions: 5.4.0.10182, 5.8.0.12848 Vulnerability Type: X.509 validation - Man-in-the-Middle CWE-300 Risk Level: Medium Solution Statu...
AudioCodes 440HD / 450HD IP Phone 3.1.2.89 Man-In-The-Middle
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Advisory ID: SYSS-2018-026 Product: 440HD / 450HD IP Phone Manufacturer: AudioCodes Affected Versions: = 3.1.2.89 Tested Versions: VC3.1.1.43.1, VC3.1.2.89 Vulnerability Type: X.509 validation - Man-in-the-Middle CWE-300 Risk Level: Medium Solution...
FTP Rush: missing X.509 validation (FTP with TLS)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-002 Product: FTP Rush Vendor: Wing FTP Software Affected Versions: v2.1.8 Tested Versions: v2.1.8 Windows 7 32 bit and Windows 8.1 64 bit Vulnerability Type: X.509 validation Risk Level: Medium Solution Status: Vendor...
Cyberduck 4.4.3 (14140 Windows) X.509 Validation Failure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2014-004 Product: Cyberduck Affected Versions: 4.4.3 14140 Windows only Not Affected Versionss: 4.4.3 14140 and 4.2.1 9350 both OS X 10.9.2 Tested Versions: 4.4.3 Windows 7 32 bit and Windows 8.1 64 bit Vulnerability Type: X.509...