Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

474new WordPress flaws this week

390,714entries in the database

1,968 results · page 9 of 40

Apr 21, 2017Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.CVE-2016-1148 · Other software · Photosynth · reported by vultures@jpcert.or.jpHigh 8.1
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
Product
Akerun
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Apr 13, 2017Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.CVE-2016-1132 · Other software · Docomo · reported by vultures@jpcert.or.jpHigh 7.5
Shoplat App for iOS 1.10.00 through 1.18.00 does not properly verify SSL certificates.
Product
Shoplat
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvndb.jvn.jp
Apr 7, 2017The Apple Music (aka com.apple.android.music) application before 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-miCVE-2017-2387 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.8
The Apple Music (aka com.apple.android.music) application before 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Apple Music
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record info-sec.ca securityfocus.com
Apr 5, 2017FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.CVE-2015-4680 · Other software · Freeradius · reported by MITREHigh 7.5
FreeRADIUS 2.2.x before 2.2.8 and 3.0.x before 3.0.9 does not properly check revocation of intermediate CA certificates.
Product
Freeradius
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.opensuse.org packetstormsecurity.com
Mar 30, 2017The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows manCVE-2017-7322 · Other software · Modx · reported by MITREHigh 8.1
The (1) update and (2) package-installation features in MODX Revolution 2.5.4-pl and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code via a crafted certificate.
Product
Modx Revolution
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com mazinahmed.net
Mar 29, 2017In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in CVE-2014-3582 · Websites & servers · Apache · reported by Red HatCritical 9.8
In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in an Ambari cluster.
Product
Ambari
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cwiki.apache.org cwiki.apache.org
Mar 16, 2017Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for MaCVE-2017-0129 · Computers, phones & browsers · Microsoft Corporation · reported by secure@microsoft.comHigh 7.5
Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka "Microsoft Lync for Mac Certificate Validation Vulnerability."
Product
Lync for Mac
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 13, 2017The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remotCVE-2016-2787 · Other software · Puppet · reported by MITREMedium 5.3
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors.
Product
Puppet Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record puppet.com puppet.com
Dec 14, 2016Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the CVE-2016-4443 · Other software · Redhat · reported by Red HatMedium 5.5
Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file.
Product
Enterprise Virtualization
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Oct 4, 2016The U by BB&T app 1.5.4 and earlier for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servCVE-2016-6550 · Other software · Bb&t · reported by cret@cert.orgMedium 5.4
The U by BB&T app 1.5.4 and earlier for iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
The U
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Sep 25, 2016WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS serversCVE-2016-4763 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Itunes
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.apple.com
Sep 23, 2016Cisco Firepower Management Center and FireSIGHT System Software 6.0.1 mishandle comparisons between URLs and X.509 certificates, which allows remote attackers tCVE-2016-6411 · Network & remote access · Cisco · reported by psirt@cisco.comHigh 7.5
Cisco Firepower Management Center and FireSIGHT System Software 6.0.1 mishandle comparisons between URLs and X.509 certificates, which allows remote attackers to bypass intended do-not-decrypt settings via a crafted URL, aka Bug ID CSCva50585.
Product
Firesight System Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com securitytracker.com
Sep 18, 2016Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.CVE-2016-4747 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.7
Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.
Product
Iphone OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.apple.com
Aug 25, 2016Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive informCVE-2016-6231 · Other software · Kaspersky · reported by MITREMedium 5.9
Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.
Product
Safe Browser
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org info-sec.ca
Jul 19, 2016Misys FusionCapital Opics Plus does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information viaCVE-2016-5655 · Other software · Misys · reported by cret@cert.orgMedium 5.9
Misys FusionCapital Opics Plus does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.
Product
Fusioncapital Opics Plus
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org securityfocus.com
Jun 17, 2016Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors.CVE-2016-5433 · Network & remote access · Citrix · reported by MITREMedium 6.1
Citrix iOS Receiver before 7.0 allows attackers to cause TLS certificates to be incorrectly validated via unspecified vectors.
Product
IOS Receiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.citrix.com support.citrix.com
Jun 13, 2016The Huawei Hilink App application before 3.19.2 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown CVE-2016-4005 · Other software · Huawei · reported by MITREMedium 5.5
The Huawei Hilink App application before 3.19.2 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008.
Product
Hilink App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com securityfocus.com
Jun 13, 2016The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknowCVE-2016-3677 · Other software · Huawei · reported by MITREMedium 6.5
The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecified impact via unknown vectors, aka HWPSIRT-2016-03008.
Product
Hilink App
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record huawei.com securityfocus.com
Jun 10, 2016The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which CVE-2016-2786 · Other software · Puppet · reported by MITRECritical 9.8
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
Product
Puppet Agent
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record puppet.com security.gentoo.org
May 10, 2016Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow CVE-2016-1115 · Websites & servers · Adobe · reported by AdobeMedium 5.9
Adobe ColdFusion 10 before Update 19, 11 before Update 8, and 2016 before Update 1 mishandles wildcards in name fields of X.509 certificates, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.
Product
Coldfusion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Apr 24, 2016Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackerCVE-2016-2113 · Other software · Samba · reported by Red HatHigh 7.4
Samba 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof LDAPS and HTTPS servers and obtain sensitive information via a crafted certificate.
Product
Samba
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record badlock.org lists.fedoraproject.org
Apr 7, 2016NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obCVE-2016-1563 · Other software · Netapp · reported by MITREMedium 6.8
NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Clustered Data Ontap
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.netapp.com security.netapp.com
Mar 23, 2016The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via unCVE-2016-1766 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
The Profiles component in Apple iOS before 9.3 does not properly validate certificates, which allows attackers to spoof an MDM profile trust relationship via unspecified vectors.
Product
Iphone OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com securitytracker.com
Mar 1, 2016The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, whicCVE-2016-2562 · Websites & servers · Phpmyadmin · reported by MITREMedium 6.8
The checkHTTP function in libraries/Config.class.php in phpMyAdmin 4.5.x before 4.5.5.1 does not verify X.509 certificates from api.github.com SSL servers, which allows man-in-the-middle attackers to spoof these servers and obtain sensitive information via a crafted certificate.
Product
Phpmyadmin
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Feb 8, 2016Dell SecureWorks app before 2.1 for iOS does not validate SSL certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive inforCVE-2016-2268 · Other software · Dell · reported by MITREMedium 6.8
Dell SecureWorks app before 2.1 for iOS does not validate SSL certificates, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Secureworks
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Nov 9, 2015The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers aCVE-2015-5655 · Other software · Adways · reported by vultures@jpcert.or.jpMedium 5.8
The Adways Party Track SDK before 1.6.6 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Party Track SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp jvn.jp
Nov 3, 2015HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtCVE-2015-2902 · Other software · HP · reported by cret@cert.orgMedium 6.8
HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows man-in-the-middle attackers to spoof devices and obtain sensitive information via a crafted certificate.
Product
Arcsight Smartconnectors
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org securitytracker.com
Sep 24, 2015The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middleCVE-2015-6303 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCut36742 and CSCut36844.
Product
Spark
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record tools.cisco.com tools.cisco.com
Sep 18, 2015VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spooCVE-2015-6932 · Other software · VMware · reported by MITREMedium 5.8
VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Vcenter Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securitytracker.com vmware.com
Sep 18, 2015The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate cCVE-2015-5824 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Watchos
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.apple.com
Aug 31, 2015The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackCVE-2015-5717 · Other software · Siemens · reported by MITREMedium 5.8
The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Compas
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siemens.com siemens.com
Aug 14, 2015Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificCVE-2015-1816 · Other software · Theforeman · reported by Red HatMedium 5
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
Product
Foreman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record projects.theforeman.org access.redhat.com
Aug 14, 2015GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a cerCVE-2014-8155 · Other software · GNU · reported by Red HatMedium 4.3
GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.
Product
Gnutls
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com securityfocus.com
Aug 3, 2015The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customCVE-2015-3960 · Other software · Garrettcom · reported by ics-cert@hq.dhs.govMedium 4.3
The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches uses hardcoded RSA private keys and certificates across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms for HTTPS sessions by leveraging knowledge of a private key from another installation.
Product
Magnum 10k Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record garrettcom.com securityfocus.com
Jul 6, 2015Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors.CVE-2015-3957 · Other software · Hospira · reported by ics-cert@hq.dhs.govMedium 4.6
Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors.
Product
Lifecare Pcainfusion Firmware
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record fda.gov securityfocus.com
Jul 5, 2015EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middlCVE-2015-0543 · Other software · EMC · reported by security_alert@emc.comMedium 5.8
EMC Secure Remote Services Virtual Edition (ESRS VE) 3.x before 3.06 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Secure Remote Services
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org securitytracker.com
Jun 2, 2015The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle CVE-2015-4094 · Other software · Thycotic · reported by MITREMedium 5.8
The Thycotic Password Manager Secret Server application through 2.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Secret Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record info-sec.ca info-sec.ca
May 25, 2015Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-midCVE-2015-0961 · Network & remote access · Barracuda · reported by cret@cert.orgMedium 4.3
Barracuda Web Filter before 8.1.0.005, when SSL Inspection is enabled, does not verify X.509 certificates from upstream SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Web Filter
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record kb.cert.org blog.barracuda.com
May 14, 2015The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.CVE-2015-0971 · Other software · Debian · reported by cret@cert.orgMedium 5
The DER parser in Suricata before 2.0.8 allows remote attackers to cause a denial of service (crash) via vectors related to SSL/TLS certificates.
Product
Debian Linux
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record suricata-ids.org debian.org
May 7, 2015The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-miCVE-2015-3610 · Other software · Siemens · reported by MITREMedium 5.4
The Siemens HomeControl for Room Automation application before 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information or modify data via a crafted certificate.
Product
Homecontrol For Room Automation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siemens.com siemens.com
Apr 10, 2015Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allCVE-2015-1147 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5
Open Directory Client in Apple OS X before 10.10.3 sends unencrypted password-change requests in certain circumstances involving missing certificates, which allows remote attackers to obtain sensitive information by sniffing the network.
Product
MAC OS X
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com securityfocus.com
Apr 10, 2015Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackersCVE-2015-1129 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.
Product
Iphone OS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apple.com lists.apple.com
Mar 23, 2015IBM PowerVC Standard 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 validates Hardware Management Console (HMC) certificates only during the pre-login stage, wCVE-2015-0137 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.3
IBM PowerVC Standard 1.2.0.x before 1.2.0.4 and 1.2.1.x before 1.2.2 validates Hardware Management Console (HMC) certificates only during the pre-login stage, which allows man-in-the-middle attackers to spoof devices via a crafted certificate.
Product
Powervc
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com www-01.ibm.com
Mar 13, 2015The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which CVE-2015-2091 · Websites & servers · Apache · reported by MITREMedium 5
The authentication hook (mgs_hook_authz) in mod-gnutls 0.5.10 and earlier does not validate client certificates when "GnuTLSClientVerify require" is set, which allows remote attackers to spoof clients via a crafted certificate.
Product
Mod-gnutls
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record issues.outoforder.cc debian.org
Mar 9, 2015Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackersCVE-2014-3691 · Other software · Redhat · reported by Red HatHigh 7.5
Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.
Product
Openstack
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record projects.theforeman.org rhn.redhat.com
Mar 6, 2015The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers tCVE-2015-1596 · Other software · Siemens · reported by MITREMedium 5.8
The Siemens SPCanywhere application for Android and iOS does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Spcanywhere
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siemens.com siemens.com
Feb 10, 2015The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it eaCVE-2015-1570 · Network & remote access · Fortinet · reported by MITREMedium 4.3
The Endpoint Control protocol implementation in Fortinet FortiClient 5.2.3.091 for Android and 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof servers via a crafted certificate.
Product
Forticlient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org security-assessment.com
Feb 10, 2015Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof SSL VPN servers via a crafteCVE-2015-1569 · Network & remote access · Fortinet · reported by MITREMedium 4.3
Fortinet FortiClient 5.2.028 for iOS does not validate certificates, which makes it easier for man-in-the-middle attackers to spoof SSL VPN servers via a crafted certificate.
Product
Forticlient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org security-assessment.com
Feb 2, 2015Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which alloCVE-2015-1454 · Other software · Bluecoat · reported by MITREHigh 7.1
Blue Coat ProxyClient before 3.3.3.3 and 3.4.x before 3.4.4.10 and Unified Agent before 4.1.3.151952 does not properly validate certain certificates, which allows man-in-the-middle attackers to spoof ProxySG Client Managers, and consequently modify configurations and execute arbitrary software updates, via a crafted certificate.
Product
Proxyclient
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record secunia.com bto.bluecoat.com
Feb 1, 2015IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackCVE-2014-8918 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.8
IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Product
Security Appscan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record www-01.ibm.com exchange.xforce.ibmcloud.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.