Filtered by CWE-295
Filtered by vendor Subscriptions
Total 1103 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2014-0161 1 Ovirt-engine-sdk-python Project 1 Ovirt-engine-sdk-python 2024-11-21 5.9 Medium
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.
CVE-2014-0104 1 Clusterlabs 1 Fence-agents 2024-11-21 5.9 Medium
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.
CVE-2014-0092 2 Gnu, Redhat 5 Gnutls, Enterprise Linux, Rhel Els and 2 more 2024-11-21 N/A
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
CVE-2014-0041 1 Redhat 1 Openstack 2024-11-21 N/A
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.
CVE-2014-0036 1 Amos Benari 1 Rbovirt 2024-11-21 N/A
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
CVE-2013-7450 1 Pulpproject 1 Pulp 2024-11-21 N/A
Pulp before 2.3.0 uses the same the same certificate authority key and certificate for all installations.
CVE-2013-7397 2 Async-http-client Project, Redhat 5 Async-http-client, Jboss Bpms, Jboss Brms and 2 more 2024-11-21 N/A
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
CVE-2013-7201 1 Paypal 1 Paypal 2024-11-21 N/A
WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
CVE-2013-6662 1 Google 1 Chrome 2024-11-21 N/A
Google Chrome caches TLS sessions before certificate validation occurs.
CVE-2013-4488 1 Libgadu 1 Libgadu 2024-11-21 N/A
libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.
CVE-2013-4111 3 Openstack, Opensuse, Redhat 3 Python Glanceclient, Opensuse, Openstack 2024-11-21 N/A
The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2013-2255 3 Debian, Openstack, Redhat 4 Debian Linux, Compute, Keystone and 1 more 2024-11-21 5.9 Medium
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
CVE-2013-10001 1 Htc 5 Mail, One Sv, One X and 2 more 2024-11-21 4.8 Medium
A vulnerability was found in HTC One/Sense 4.x. It has been rated as problematic. Affected by this issue is the certification validation of the mail client. An exploit has been disclosed to the public and may be used.
CVE-2013-0776 5 Canonical, Debian, Mozilla and 2 more 14 Ubuntu Linux, Debian Linux, Firefox and 11 more 2024-11-21 N/A
Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.
CVE-2013-0264 1 Redhat 1 Mrg Management Console 2024-11-21 7.5 High
An import error was introduced in Cumin in the code refactoring in r5310. Server certificate validation is always disabled when connecting to Aviary servers, even if the installed packages on a system support it.
CVE-2012-6709 2 Elinks, Twibright 2 Elinks, Links 2024-11-21 N/A
ELinks 0.12 and Twibright Links 2.3 have Missing SSL Certificate Validation.
CVE-2012-6071 2 Debian, Nusoap Project 2 Debian Linux, Nusoap 2024-11-21 7.5 High
nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.
CVE-2012-5824 1 Cerulean Studios 1 Trillian 2024-11-21 N/A
Trillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, a different vulnerability than CVE-2009-4831.
CVE-2012-5822 1 Mozilla 1 Zamboni 2024-11-21 7.4 High
The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python urllib2 library.
CVE-2012-5821 2 Canonical, Lynx 2 Ubuntu Linux, Lynx 2024-11-21 5.9 Medium
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.