Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 125

Export CSV
CVE-2014-3607

vtldap/ldaptive: Hostname verification susceptible to MITM attack

DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ldaptive
Products
Ldaptive Vt-ldap
CVE-2014-3603

Java: HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Shibboleth
Products
Identity Provider Opensaml Java
CVE-2024-38324

IBM Storage Defender improper certificate validation

IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Storage Defender Storage Defender Resiliency Service
CVE-2024-7346

Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation

Host name validation for TLS certificates is bypassed when the installed OpenEdge default certificates are used to perform the TLS handshake for a networked connection.  This has been corrected so that default certificates are no longer capable of overriding host name validation and will need to be replaced where full TLS certificate validation is needed for network security.  The existing certificates should be replaced with CA-signed certificates from a recognized certificate authority that contain the necessary information to support host name validation.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Openedge