Export limit exceeded: 403520 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (2984 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-24714 | 1 Scalyr | 1 Scalyr Agent | 2024-11-21 | 9.8 Critical |
| The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without the -verify_hostname option. | ||||
| CVE-2020-24661 | 2 Fedoraproject, Gnome | 2 Fedora, Geary | 2024-11-21 | 5.9 Medium |
| GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail. | ||||
| CVE-2020-24619 | 1 Meltytech | 1 Shotcut | 2024-11-21 | 5.9 Medium |
| In mainwindow.cpp in Shotcut before 20.09.13, the upgrade check misuses TLS because of setPeerVerifyMode(QSslSocket::VerifyNone). A man-in-the-middle attacker could offer a spoofed download resource. | ||||
| CVE-2020-24613 | 1 Wolfssl | 1 Wolfssl | 2024-11-21 | 6.8 Medium |
| wolfSSL before 4.5.0 mishandles TLS 1.3 server data in the WAIT_CERT_CR state, within SanityCheckTls13MsgReceived() in tls13.c. This is an incorrect implementation of the TLS 1.3 client state machine. This allows attackers in a privileged network position to completely impersonate any TLS 1.3 servers, and read or modify potentially sensitive information between clients using the wolfSSL library and these TLS servers. | ||||
| CVE-2020-24560 | 2 Microsoft, Trendmicro | 6 Windows, Antivirus\+ 2019, Internet Security 2019 and 3 more | 2024-11-21 | 7.5 High |
| An incomplete SSL server certification validation vulnerability in the Trend Micro Security 2019 (v15) consumer family of products could allow an attacker to combine this vulnerability with another attack to trick an affected client into downloading a malicious update instead of the expected one. CWE-295: Improper server certificate verification in the communication with the update server. | ||||
| CVE-2020-24393 | 1 Tweetstream Project | 1 Tweetstream | 2024-11-21 | 5.9 Medium |
| TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack. | ||||
| CVE-2020-24392 | 1 Twitter-stream Project | 1 Twitter-stream | 2024-11-21 | 5.9 Medium |
| In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused). | ||||
| CVE-2020-24375 | 1 Free | 3 Freebox Server, Freebox V5, Freebox V5 Firmware | 2024-11-21 | 6.5 Medium |
| A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3. | ||||
| CVE-2020-24025 | 1 Sass-lang | 1 Node-sass | 2024-11-21 | 5.3 Medium |
| Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. | ||||
| CVE-2020-23178 | 1 Php-fusion | 1 Php-fusion | 2024-11-21 | 5.4 Medium |
| An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user. | ||||
| CVE-2020-22001 | 1 Homeautomation Project | 1 Homeautomation | 2024-11-21 | 9.8 Critical |
| HomeAutomation 3.3.2 suffers from an authentication bypass vulnerability when spoofing client IP address using the X-Forwarded-For header with the local (loopback) IP address value allowing remote control of the smart home solution. | ||||
| CVE-2020-1952 | 1 Apache | 1 Iotdb | 2024-11-21 | 9.8 Critical |
| An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely. | ||||
| CVE-2020-1929 | 1 Apache | 1 Beam | 2024-11-21 | 7.5 High |
| The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM. | ||||
| CVE-2020-1887 | 1 Linuxfoundation | 1 Osquery | 2024-11-21 | 9.1 Critical |
| Incorrect validation of the TLS SNI hostname in osquery versions after 2.9.0 and before 4.2.0 could allow an attacker to MITM osquery traffic in the absence of a configured root chain of trust. | ||||
| CVE-2020-1758 | 1 Redhat | 4 Jboss Single Sign On, Keycloak, Openstack and 1 more | 2024-11-21 | 5.3 Medium |
| A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack. | ||||
| CVE-2020-1675 | 1 Juniper | 1 Mist Cloud Ui | 2024-11-21 | 8.3 High |
| When Security Assertion Markup Language (SAML) authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certificates which could allow a malicious network-based user to access unauthorized data. This issue affects all Juniper Networks Mist Cloud UI versions prior to September 2 2020. | ||||
| CVE-2020-1331 | 1 Microsoft | 1 System Center Operations Manager | 2024-11-21 | 5.4 Medium |
| A spoofing vulnerability exists when System Center Operations Manager (SCOM) does not properly sanitize a specially crafted web request to an affected SCOM instance, aka 'System Center Operations Manager Spoofing Vulnerability'. | ||||
| CVE-2020-1329 | 1 Microsoft | 1 Bing | 2024-11-21 | 6.5 Medium |
| A spoofing vulnerability exists when Microsoft Bing Search for Android improperly handles specific HTML content, aka 'Microsoft Bing Search Spoofing Vulnerability'. | ||||
| CVE-2020-19003 | 1 Liftoffsoftware | 1 Gate One | 2024-11-21 | 5.3 Medium |
| An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list. | ||||
| CVE-2020-17516 | 1 Apache | 1 Cassandra | 2024-11-21 | 7.5 High |
| Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted and unencrypted internode connections. A misconfigured node or a malicious user can use the unencrypted connection despite not being in the same rack or dc, and bypass mutual TLS requirement. | ||||