Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,968 results · page 5 of 40
May 21, 2021It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator CVE-2008-3280 · Other software · Openid · reported by Red HatMedium 5.9
It was found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue (CVE-2008-1447) and the fact that almost all SSL/TLS implementations do not consult CRLs (currently an untracked issue), this means that it is impossible to rely on these OPs.
- Product
- Openid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.openid.netexploit-db.com
May 17, 2021A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval.CVE-2007-5967 · Computers, phones & browsers · Mozilla · reported by Red HatMedium 6.5
A flaw in Mozilla's embedded certificate code might allow web sites to install root certificates on devices without user approval.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla-dev.allizom.orgbugzilla-dev.allizom.org
Apr 22, 2021HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL.CVE-2021-29653 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Apr 22, 2021HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connectiCVE-2021-27400 · Other software · Hashicorp · reported by MITREHigh 7.5
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1
- Product
- Vault
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.hashicorp.comdiscuss.hashicorp.com
Mar 25, 2021The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.CVE-2021-3450 · Websites & servers · OpenSSL · reported by openssl-security@openssl.orgHigh 7.4
The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain. It is not set by default. Starting from OpenSSL version 1.1.1h a check to disallow certificates in the chain that have explicitly encoded elliptic curve parameters was added as an additional strict check. An error in the implementation of this check meant that the result of a previous check to confirm that certificates in the chain are valid CA certificates was overwritten. This effectively bypasses the check that non-CA certificates must not be able to issue other certificates. If a "purpose" has been configured then there is a subsequent opportunity for checks that the certificate is a valid CA. All of the named "purpose" values implemented in libcrypto perform this check. Therefore, where a purpose is set the certificate chain will still be rejected even when the strict flag has been used. A purpose is set by default in libssl client and server certificate verification routines, but it can be overridden or removed by an application. In order to be affected, an application must explicitly set the X509_V_FLAG_X509_STRICT verification flag and either not set a pur
- Product
- OpenSSL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comopenwall.com
Mar 15, 2021If certificates that signed grub are installed into db, grub can be booted directly.CVE-2021-3418 · Other software · GNU · reported by Red HatMedium 6.4
If certificates that signed grub are installed into db, grub can be booted directly. It will then boot any kernel without signature validation. The booted kernel will think it was booted in secureboot mode and will implement lockdown, yet it could have been tampered. This flaw is a reintroduction of CVE-2020-15705 and only affects grub2 versions prior to 2.06 and upstream and distributions using the shim_lock mechanism.
- Product
- Grub2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 4, 2021Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that cCVE-2021-22189 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 5.9
Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 23, 2021A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options.CVE-2021-20230 · Other software · Stunnel · reported by Red HatHigh 7.5
A flaw was found in stunnel before 5.57, where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate signed by a Certificate Authority, which is not the one accepted by the stunnel server, to access the tunneled service instead of being redirected to the address specified in the redirect option. The highest threat from this vulnerability is to confidentiality.
- Product
- Stunnel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comgithub.com
Jan 26, 2021jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS.CVE-2021-3285 · Other software · TI · reported by MITREMedium 5.3
jxbrowser in TI Code Composer Studio IDE 8.x through 10.x before 10.1.1 does not verify X.509 certificates for HTTPS.
- Product
- Code Composer Studio Intgrated Development Environment
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsir.ext.ti.comsir.ext.ti.com
Dec 15, 2020Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL.CVE-2020-29663 · Other software · Icinga · reported by MITRECritical 9.1
Icinga 2 v2.8.0 through v2.11.7 and v2.12.2 has an issue where revoked certificates due for renewal will automatically be renewed, ignoring the CRL. This issue is fixed in Icinga 2 v2.11.8 and v2.12.3.
- Product
- Icinga
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2020In createNameCredentialDialog of CertInstaller.java, there exists the possibility of improperly installed certificates due to a logic error.CVE-2020-0460 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.5
In createNameCredentialDialog of CertInstaller.java, there exists the possibility of improperly installed certificates due to a logic error. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-163413737
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Nov 18, 2020Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.CVE-2020-8279 · Other software · Nextcloud · reported by support@hackerone.comHigh 7.4
Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.
- Product
- Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comnextcloud.com
Nov 6, 2020Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.CVE-2020-27589 · Other software · Synopsys · reported by MITREHigh 7.5
Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
- Product
- Hub-rest-api-python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.synopsys.comgithub.com
Nov 6, 2020The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.CVE-2020-17490 · Other software · Saltstack · reported by MITREMedium 5.5
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.opensuse.orgdocs.saltstack.com
Oct 27, 2020An issue existed in the handling of S-MIME certificates.CVE-2019-8642 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
An issue existed in the handling of S-MIME certificates. This issue was addressed with improved validation of S-MIME certificates. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra. Processing a maliciously crafted mail message may lead to S/MIME signature spoofing.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 22, 2020A certificate validation issue existed when processing administrator added certificates.CVE-2020-9868 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.1
A certificate validation issue existed when processing administrator added certificates. This issue was addressed with improved certificate validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8, watchOS 6.2.8. An attacker may have been able to impersonate a trusted website using shared key material for an administrator added certificate.
- Product
- iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 14, 2020Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not exclCVE-2020-3483 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.1
Duo has identified and fixed an issue with the Duo Network Gateway (DNG) product in which some customer-provided SSL certificates and private keys were not excluded from logging. This issue resulted in certificate and private key information being written out in plain-text to local files on the DNG host. Any private keys logged in this way could be viewed by those with access to the DNG host operating system without any need for reversing encrypted values or similar techniques. An attacker that gained access to the DNG logs and with the ability to intercept and manipulate network traffic between a user and the DNG, could decrypt and manipulate SSL/TLS connections to the DNG and to the protected applications behind it. Duo Network Gateway (DNG) versions 1.3.3 through 1.5.7 are affected.
- Product
- Duo Network Gateway (DNG)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2020lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which alloCVE-2016-11086 · Other software · Oauth-ruby Project · reported by MITREHigh 7.4
lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
- Product
- Oauth-ruby
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 31, 2020The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which alCVE-2020-11617 · Other software · Thomsonstb · reported by MITREMedium 5.9
The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers, which allows a man-in-the-middle attacker to modify the data delivered to the client.
- Product
- Tht741fta Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddecoded.avast.iodecoded.avast.io
Aug 26, 2020GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificatCVE-2020-24661 · Other software · Gnome · reported by MITREMedium 5.9
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail.
- Product
- Geary
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orglists.fedoraproject.org
Aug 21, 2020NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can bCVE-2020-10125 · Other software · NCR · reported by cret@cert.orgHigh 7.6
NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates, which can be broken by an attacker with physical access in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code.
- Product
- SelfServ ATM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2020MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones.CVE-2020-12619 · Other software · Freron · reported by MITREMedium 5.9
MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.
- Product
- Mailmate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordupdates.mailmate-app.comnds.ruhr-uni-bochum.de
Aug 20, 2020eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones.CVE-2020-12618 · Other software · Emclient · reported by MITREMedium 4.8
eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.
- Product
- EM Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordemclient.comnds.ruhr-uni-bochum.de
Jul 14, 2020In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative NCVE-2020-15104 · Other software · envoyproxy · reported by GitHubMedium 4.6
In Envoy before versions 1.12.6, 1.13.4, 1.14.4, and 1.15.0 when validating TLS certificates, Envoy would incorrectly allow a wildcard DNS Subject Alternative Name apply to multiple subdomains. For example, with a SAN of *.example.com, Envoy would incorrectly allow nested.subdomain.example.com, when it should only allow subdomain.example.com. This defect applies to both validating a client TLS certificate in mTLS, and validating a server TLS certificate for upstream connections. This vulnerability is only applicable to situations where an untrusted entity can obtain a signed wildcard TLS certificate for a domain of which you only intend to trust a subdomain of. For example, if you intend to trust api.mysubdomain.example.com, and an untrusted actor can obtain a signed TLS certificate for *.example.com or *.com. Configurations are vulnerable if they use verify_subject_alt_name in any Envoy version, or if they use match_subject_alt_names in version 1.14 or later. This issue has been fixed in Envoy versions 1.12.6, 1.13.4, 1.14.4, 1.15.0.
- Product
- envoy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2020lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.CVE-2020-13615 · Other software · Qore · reported by MITREMedium 5.9
lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verification for X.509 certificates.
- Product
- Qore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2020Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middCVE-2020-2187 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.6
Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation, enabling man-in-the-middle attacks.
- Product
- Jenkins Amazon EC2 Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Apr 28, 2020When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys.CVE-2020-1774 · Other software · OTRS AG · reported by security@otrs.comMedium 4.5
When user downloads PGP or S/MIME keys/certificates, exported file has same name for private and public keys. Therefore it's possible to mix them and to send private key to the third-party instead of public key. This issue affects ((OTRS)) Community Edition: 5.0.42 and prior versions, 6.0.27 and prior versions. OTRS: 7.0.16 and prior versions.
- Product
- ((OTRS)) Community Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Apr 9, 2020X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDCVE-2020-7922 · Other software · MongoDB Inc. · reported by cna@mongodb.comMedium 6.4
X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected. This issue affects MongoDB Enterprise Kubernetes Operator version 1.0, MongoDB Enterprise Kubernetes Operator version 1.1, MongoDB Enterprise Kubernetes Operator version 1.2 versions prior to 1.2.4, MongoDB Enterprise Kubernetes Operator version 1.3 versions prior to 1.3.1, 1.2, 1.4 versions prior to 1.4.4.
- Product
- MongoDB Enterprise Kubernetes Operator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2020Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi cCVE-2020-11490 · Other software · Zevenet · reported by MITREHigh 7.2
Manage::Certificates in Zen Load Balancer 3.10.1 allows remote authenticated admins to execute arbitrary OS commands via shell metacharacters in the index.cgi cert_issuer, cert_division, cert_organization, cert_locality, cert_state, cert_country, or cert_email parameter.
- Product
- ZEN Load Balancer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comgithub.com
Mar 30, 2020The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads.CVE-2019-17560 · Websites & servers · Apache · reported by security@apache.orgCritical 9.1
The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
- Product
- Netbeans
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgoracle.com
Mar 19, 2020Open edX Ironwood.1 allows support/certificates?user= reflected XSS.CVE-2019-20513 · Other software · EDX · reported by MITREMedium 6.1
Open edX Ironwood.1 allows support/certificates?user= reflected XSS.
- Product
- Open EDX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 18, 2020Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.CVE-2019-20512 · Other software · Open.edx · reported by MITREMedium 6.1
Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.
- Product
- Ironwood
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetsparker.comnetsparker.com
Mar 10, 2020NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new CVE-2012-1096 · Other software · GNOME · reported by Red HatMedium 5.5
NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection.
- Product
- NetworkManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comaccess.redhat.com
Mar 9, 2020Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-midCVE-2020-8987 · Other software · Avast · reported by MITREHigh 7.4
Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates, and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with "Allow filtering of HTTPS traffic for tracking detection" enabled. (This is the default configuration.)
- Product
- Antitrack
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordavast.comdavideade.com
Jan 31, 2020HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to CVE-2020-7956 · Other software · Hashicorp · reported by MITRECritical 9.8
HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to privilege escalation. Fixed in 0.10.3.
- Product
- Nomad
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhashicorp.com
Jan 30, 2020The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attackCVE-2020-5526 · Other software · Fuji Xerox Co.,Ltd. · reported by vultures@jpcert.or.jpMedium 5.9
The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- AWMS Mobile App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jponlinesupport.fujixerox.com
Jan 28, 2020Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properlCVE-2020-5523 · Other software · NTT Data Corporation · reported by vultures@jpcert.or.jpHigh 7.4
Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers, and also do not properly validate certificates with host-mismatch, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- 'MyPallete' and some of the Android banking applications that use 'MyPallete'
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpdokodemobank.ne.jp
Jan 27, 2020The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof serversCVE-2020-5522 · Other software · Fuji Xerox Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 7.4
The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- kantan netprint App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2020The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers andCVE-2020-5521 · Other software · Fuji Xerox Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 7.4
The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- kantan netprint App for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2020The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtainCVE-2020-5520 · Other software · Fuji Xerox Co.,Ltd. · reported by vultures@jpcert.or.jpHigh 7.4
The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- netprint App for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2020Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.CVE-2011-2669 · Computers, phones & browsers · Mozilla · reported by vultures@jpcert.or.jpMedium 6.5
Mozilla Firefox prior to 3.6 has a DoS vulnerability due to an issue in the validation of certificates.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2020In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackeCVE-2014-0104 · Other software · fence-agents · reported by Red HatMedium 5.9
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.
- Product
- fence-agents
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 26, 2019The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensCVE-2019-6032 · Other software · Nippon Television Network Corporation · reported by vultures@jpcert.or.jpHigh 7.4
The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- NTV News24
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2019duplicity 0.6.24 has improper verification of SSL certificatesCVE-2014-3495 · Other software · duplicity · reported by Red HatHigh 7.5
duplicity 0.6.24 has improper verification of SSL certificates
- Product
- duplicity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Dec 3, 2019A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.CVE-2015-7542 · Other software · libgwenhywfar · reported by Red HatMedium 5.3
A vulnerability exists in libgwenhywfar through 4.12.0 due to the usage of outdated bundled CA certificates.
- Product
- libgwenhywfar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Nov 21, 2019wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.CVE-2014-2902 · Other software · Wolfssl · reported by MITREHigh 7.5
wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.debian.org
Nov 21, 2019wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.CVE-2014-2901 · Other software · Wolfssl · reported by MITREHigh 7.5
wolfssl before 3.2.0 does not properly issue certificates for a server's hostname.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurity-tracker.debian.org
Nov 5, 2019Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binaryCVE-2019-3685 · Other software · Open Build Service · reported by meissner@suse.deHigh 7.4
Open Build Service before version 0.165.4 diddn't validate TLS certificates for HTTPS connections with the osc client binary
- Product
- Open Build Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.combugzilla.suse.com
Nov 4, 2019RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificatesCVE-2013-4518 · Other software · RHUI · reported by Red HatMedium 5.5
RHUI (Red Hat Update Infrastructure) 2.1.3 has world readable PKI entitlement certificates
- Product
- RHUI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Nov 1, 2019HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.CVE-2013-2255 · Other software · OpenStack · reported by Red HatMedium 5.9
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
- Product
- Keystone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugs.launchpad.net
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.