CWE:

	Topic	Date	Author
Med.	Fortinet FortiSIEM 5.0 / 5.2.1 Improper Certification Validation	02.10.2019	Andrew Klaus
Med.	Magento 1.9.x Multiple Man-In The Middle	20.01.2016	Maksymilian Arciemowic...
Med.	phpMyAdmin 4.4.6 Man-In-the-Middle to API Github	14.05.2015	Maksymilian Arciemowic...
Low	PicsArt Photo Studio For Android Insecure Management	07.11.2014	Fundacion Dr. Manuel S...

---

CVEMAP Search Results

CVE

Details

Description

2023-05-03

	CVE-2023-24461	Updating...	An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
	CVE-2022-39161	Updating...	IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks. A man-in-the-middle attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 235069.

2023-04-04

CVE-2023-29000

Updating...

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.7.0, by trusting that the server will return a certificate that belongs to the keypair of the user, a malicious server could get the desktop client to encrypt files with a key known to the attacker. This issue is fixed in Nextcloud Desktop 3.7.0. No known workarounds are available.

2023-03-29

CVE-2022-27644

Updating...

This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15797.

2023-01-30

CVE-2022-32748

Updating...

2023-01-26

CVE-2023-0509

Updating...

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

2022-12-15

CVE-2022-32531

Updating...

The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 and 4.15.1.

2022-11-25

CVE-2022-39334

Updating...

Nextcloud desktop is the desktop sync client for Nextcloud. Versions prior to 3.6.1 would incorrectly trust invalid TLS certificates. A Man-in-the-middle attack is possible in case a user can be made running a nextcloudcmd CLI command locally. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this vulnerability.

2022-11-15

	CVE-2022-38666	Updating...	Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.
	CVE-2022-45391	Updating...	Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM.

 

---

Copyright 2023, cxsecurity.com