CWE-297 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-297/ Sun, 26 Feb 2023 06:45:03 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-297 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-297/ 32 32 CVE-2018-10936 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-10936/ Sun, 26 Feb 2023 06:45:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-10936/ A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for […]

The post CVE-2018-10936 appeared first on CVE Vulnerability.

]]> A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.

The post CVE-2018-10936 appeared first on CVE Vulnerability.

]]> CVE-2020-14387 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-14387/ Sun, 26 Feb 2023 06:37:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-14387/ A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability […]

The post CVE-2020-14387 appeared first on CVE Vulnerability.

]]> A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote, unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.

The post CVE-2020-14387 appeared first on CVE Vulnerability.

]]> CVE-2021-21385 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-21385/ Thu, 23 Feb 2023 14:07:00 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-21385/ Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for […]

The post CVE-2021-21385 appeared first on CVE Vulnerability.

]]> Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate, even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.

The post CVE-2021-21385 appeared first on CVE Vulnerability.

]]> CVE-2022-41243 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-41243/ Thu, 23 Feb 2023 05:20:44 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-41243/ Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.

The post CVE-2022-41243 appeared first on CVE Vulnerability.

]]> Jenkins SmallTest Plugin 1.0.4 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.

The post CVE-2022-41243 appeared first on CVE Vulnerability.

]]> CVE-2022-41244 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-41244/ Thu, 23 Feb 2023 05:20:44 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-41244/ Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.

The post CVE-2022-41244 appeared first on CVE Vulnerability.

]]> Jenkins View26 Test-Reporting Plugin 1.0.7 and earlier does not perform hostname validation when connecting to the configured View26 server that could be abused using a man-in-the-middle attack to intercept these connections.

The post CVE-2022-41244 appeared first on CVE Vulnerability.

]]>