Filtered by CWE-295
Total 1247 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-10534 1 Electron-packager Project 1 Electron-packager 2024-11-21 N/A
electron-packager is a command line tool that packages Electron source code into `.app` and `.exe` packages. along with Electron. The `--strict-ssl` command line option in electron-packager >= 5.2.1 <= 6.0.0 || >=6.0.0 <= 6.0.2 defaults to false if not explicitly set to true. This could allow an attacker to perform a man in the middle attack.
CVE-2016-1000030 2 Pidgin, Suse 2 Pidgin, Linux Enterprise Server 2024-11-21 N/A
Pidgin version <2.11.0 contains a vulnerability in X.509 Certificates imports specifically due to improper check of return values from gnutls_x509_crt_init() and gnutls_x509_crt_import() that can result in code execution. This attack appear to be exploitable via custom X.509 certificate from another client. This vulnerability appears to have been fixed in 2.11.0.
CVE-2015-4954 1 Ibm 1 Bigfix Remote Control 2024-11-21 N/A
IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow remote attackers to conduct spoofing attacks via unspecified vectors. IBM X-Force ID: 105200.
CVE-2015-2981 1 Yodobashi 1 Yodobashi 2024-11-21 N/A
The Yodobashi App for Android 1.2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2015-2320 2 Debian, Mono-project 2 Debian Linux, Mono 2024-11-21 N/A
The TLS stack in Mono before 3.12.1 allows remote attackers to have unspecified impact via vectors related to client-side SSLv2 fallback.
CVE-2015-2319 1 Mono-project 1 Mono 2024-11-21 N/A
The TLS stack in Mono before 3.12.1 makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORT_RSA ciphers via crafted TLS traffic, related to the "FREAK" issue, a different vulnerability than CVE-2015-0204.
CVE-2015-2318 2 Debian, Mono-project 2 Debian Linux, Mono 2024-11-21 N/A
The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a "SMACK SKIP-TLS" issue.
CVE-2015-1777 1 Redhat 3 Enterprise Linux, Gluster Storage, Rhn-client-tools 2024-11-21 N/A
rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.
CVE-2015-0294 3 Debian, Gnu, Redhat 3 Debian Linux, Gnutls, Enterprise Linux 2024-11-21 7.5 High
GnuTLS before 3.3.13 does not validate that the signature algorithms match when importing a certificate.
CVE-2014-8167 1 Redhat 3 Enterprise Virtualization, Vdsclient, Virtual Desktop Server Manager 2024-11-21 5.9 Medium
vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack
CVE-2014-8164 1 Redhat 1 Cloudforms Management Engine 2024-11-21 9.1 Critical
A insecure configuration for certificate verification (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) may lead to verification bypass in Red Hat CloudForms 5.x.
CVE-2014-3607 1 Ldaptive 2 Ldaptive, Vt-ldap 2024-11-21 N/A
DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2014-3495 2 Debian, Opensuse 3 Debian Linux, Duplicity, Opensuse 2024-11-21 7.5 High
duplicity 0.6.24 has improper verification of SSL certificates
CVE-2014-3230 1 Lwp\ 1 \ 2024-11-21 5.9 Medium
The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.
CVE-2014-2902 1 Wolfssl 1 Wolfssl 2024-11-21 7.5 High
wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
CVE-2014-2901 1 Wolfssl 1 Wolfssl 2024-11-21 7.5 High
wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
CVE-2014-0161 1 Ovirt-engine-sdk-python Project 1 Ovirt-engine-sdk-python 2024-11-21 5.9 Medium
ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.
CVE-2014-0104 1 Clusterlabs 1 Fence-agents 2024-11-21 5.9 Medium
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.
CVE-2013-7201 1 Paypal 1 Paypal 2024-11-21 N/A
WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
CVE-2013-2255 3 Debian, Openstack, Redhat 4 Debian Linux, Compute, Keystone and 1 more 2024-11-21 5.9 Medium
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.