Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 127

CVE-2015-1855

ruby: OpenSSL extension hostname matching implementation violates RFC 6125

verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters.

CVSS 3.1 · 5.9 Medium EPSS 2.8% KEV · Not listed
Vendors
Debian Puppet Ruby-lang
Products
Debian Linux Puppet Agent Puppet Enterprise and 2 more
CVE-2015-1777

rhn-setup: rhnreg_ks fails to properly validate SSL/TLS certificates

rhnreg_ks in Red Hat Network Client Tools (aka rhn-client-tools) on Red Hat Gluster Storage 2.1 and Enterprise Linux (RHEL) 5, 6, and 7 does not properly validate hostnames in X.509 certificates from SSL servers, which allows remote attackers to prevent system registration via a man-in-the-middle attack.

CVSS 3.0 · 5.9 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Gluster Storage Rhn-client-tools
CVE-2014-3607

vtldap/ldaptive: Hostname verification susceptible to MITM attack

DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ldaptive
Products
Ldaptive Vt-ldap
CVE-2014-3603

Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Shibboleth
Products
Identity Provider Opensaml Java
CVE-2024-38324

IBM Storage Defender improper certificate validation

IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Storage Defender Storage Defender Resiliency Service
CVE-2024-7346

Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Openedge