CVEs

347,154 total · page 5878 of 6,944

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2012-5822	Mozilla Corporation Zamboni	Hig	0.48	7.4	0.01	Nov 4, 2012	The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5821	Lynx Lynx	Med	0.38	5.9	0.01	Nov 4, 2012	Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
CVE-2012-5820	Google Admob		0.00	—	0.00	Nov 4, 2012	The developer-account sample code in Google AdMob does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5819	Filesanywhere Filesanywhere	Hig	0.48	7.4	0.01	Nov 4, 2012	FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5818	Elephantdrive Elephantdrive		0.00	—	0.01	Nov 4, 2012	ElephantDrive does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5817	Xfire Xfire	Hig	0.48	7.4	0.01	Nov 4, 2012	Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
CVE-2012-5816	AOL Aim		0.00	—	0.01	Nov 4, 2012	AOL Instant Messenger (AIM) 1.0.1.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5815	Rackspace Rackspace		0.00	—	0.01	Nov 4, 2012	The Rackspace app 2.1.5 for iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5814	GitHub Gaug.es		0.00	—	0.01	Nov 4, 2012	Weberknecht, as used in GitHub Gaug.es and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an…
CVE-2012-5813	Android Pusher Android_Pusher		0.00	—	0.01	Nov 4, 2012	The Android_Pusher library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5812	Acra Acra Library		0.00	—	0.01	Nov 4, 2012	The ACRA library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5811	Breezy Breezy		0.00	—	0.01	Nov 4, 2012	The Breezy application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5810	Chase Chase Mobile	Med	0.38	5.9	0.00	Nov 4, 2012	The Chase mobile banking application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5809	Groupon Redemptions		0.00	—	0.01	Nov 4, 2012	The Groupon Redemptions application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5808	Zen Cart LinkPoint		0.00	—	0.01	Nov 4, 2012	The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5807	Zen Cart Authorize.Net eCheck module		0.00	—	0.01	Nov 4, 2012	The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5806	Paypal Payments Pro		0.00	—	0.01	Nov 4, 2012	The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5805	Paypal Instant Payment Notification		0.00	—	0.01	Nov 4, 2012	The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5804	Ubercart Ubercart		0.00	—	0.01	Nov 4, 2012	The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5803	Ubercart Ubercart		0.00	—	0.01	Nov 4, 2012	The Authorize.Net module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5802	Ubercart Ubercart		0.00	—	0.01	Nov 4, 2012	The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5801	Prestashop Prestashop		0.00	—	0.01	Nov 4, 2012	The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate,…
CVE-2012-5800	Prestashop Prestashop		0.00	—	0.01	Nov 4, 2012	The eBay module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5799	Prestashop Prestashop		0.00	—	0.01	Nov 4, 2012	The Canada Post (aka CanadaPost) module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5798	OsCommerce Oscommerce		0.00	—	0.01	Nov 4, 2012	The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5797	OsCommerce Oscommerce		0.00	—	0.01	Nov 4, 2012	The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5796	OsCommerce Oscommerce		0.00	—	0.01	Nov 4, 2012	The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5795	OsCommerce Oscommerce		0.00	—	0.01	Nov 4, 2012	The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5794	OsCommerce Oscommerce		0.00	—	0.01	Nov 4, 2012	The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5793	OsCommerce Oscommerce		0.00	—	0.01	Nov 4, 2012	The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5792	OsCommerce Oscommerce		0.00	—	0.01	Nov 4, 2012	The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5791	Paypal Invoicing		0.00	—	0.01	Nov 4, 2012	PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5790	Paypal Payments Standard		0.00	—	0.01	Nov 4, 2012	PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5789	Paypal Payments Standard		0.00	—	0.01	Nov 4, 2012	PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5788	Paypal Ipn		0.00	—	0.01	Nov 4, 2012	The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to…
CVE-2012-5787	Paypal Merchant Sdk PHP		0.00	—	0.01	Nov 4, 2012	The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5786	Apache Cxf		0.00	—	0.01	Nov 4, 2012	The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate,…
CVE-2012-5785	Apache Axis2		0.00	—	0.02	Nov 4, 2012	Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5784	Apache Axis		0.00	—	0.06	Nov 4, 2012	Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's…
CVE-2012-5783	Apache Httpclient		0.01	—	0.09	Nov 4, 2012	Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
CVE-2012-5782	Amazon Flexible Payments Service		0.00	—	0.01	Nov 4, 2012	Amazon Flexible Payments Service (FPS) PHP Library does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5781	Amazon Elastic Load Balancing		0.00	—	0.01	Nov 4, 2012	Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5780	Amazon Merchant SDK		0.00	—	0.01	Nov 4, 2012	The Amazon merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-3446	Apache Libcloud	Med	0.31	5.9	0.01	Nov 4, 2012	Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL…
CVE-2012-5170	Simon Brown Pebble		0.00	—	0.01	Nov 4, 2012	Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2012-4987	RealNetworks Realplayer		0.00	—	0.03	Nov 4, 2012	Stack-based buffer overflow in RealNetworks RealPlayer 15.0.5.109 allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP file that triggers incorrect processing of long pathnames by the Watch Folders feature.
CVE-2012-3750	Apple Inc. iOS		0.00	—	0.00	Nov 3, 2012	The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors.
CVE-2012-3749	Apple Inc. iOS		0.00	—	0.02	Nov 3, 2012	The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
CVE-2012-3748	Apple Inc. Safari		0.04	—	0.17	Nov 3, 2012	Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.
CVE-2012-0025	IrfanView Flashpix Plugin		0.04	—	0.06	Nov 2, 2012	Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the FlashPix PlugIn 4.2.2.0 for IrfanView, allows remote attackers to cause a denial of service (crash) via a crafted FPX image.

CVE-2012-5822HigNov 4, 2012
Mozilla Corporation
Zamboni
risk 0.48cvss 7.4epss 0.01
The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5821MedNov 4, 2012
Lynx
Lynx
risk 0.38cvss 5.9epss 0.01
Lynx does not verify that the server's certificate is signed by a trusted certification authority, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate, related to improper use of a certain GnuTLS function.
CVE-2012-5820Nov 4, 2012
Google
Admob
risk 0.00cvss —epss 0.00
The developer-account sample code in Google AdMob does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5819HigNov 4, 2012
Filesanywhere
Filesanywhere
risk 0.48cvss 7.4epss 0.01
FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5818Nov 4, 2012
Elephantdrive
Elephantdrive
risk 0.00cvss —epss 0.01
ElephantDrive does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5817HigNov 4, 2012
Xfire
Xfire
risk 0.48cvss 7.4epss 0.01
Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
CVE-2012-5816Nov 4, 2012
AOL
Aim
risk 0.00cvss —epss 0.01
AOL Instant Messenger (AIM) 1.0.1.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5815Nov 4, 2012
Rackspace
Rackspace
risk 0.00cvss —epss 0.01
The Rackspace app 2.1.5 for iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5814Nov 4, 2012
GitHub
Gaug.es
risk 0.00cvss —epss 0.01
Weberknecht, as used in GitHub Gaug.es and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an…
CVE-2012-5813Nov 4, 2012
Android Pusher
Android_Pusher
risk 0.00cvss —epss 0.01
The Android_Pusher library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5812Nov 4, 2012
Acra
Acra Library
risk 0.00cvss —epss 0.01
The ACRA library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5811Nov 4, 2012
Breezy
Breezy
risk 0.00cvss —epss 0.01
The Breezy application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5810MedNov 4, 2012
Chase
Chase Mobile
risk 0.38cvss 5.9epss 0.00
The Chase mobile banking application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5809Nov 4, 2012
Groupon
Redemptions
risk 0.00cvss —epss 0.01
The Groupon Redemptions application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5808Nov 4, 2012
Zen Cart
LinkPoint
risk 0.00cvss —epss 0.01
The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5807Nov 4, 2012
Zen Cart
Authorize.Net eCheck module
risk 0.00cvss —epss 0.01
The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5806Nov 4, 2012
Paypal
Payments Pro
risk 0.00cvss —epss 0.01
The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5805Nov 4, 2012
Paypal
Instant Payment Notification
risk 0.00cvss —epss 0.01
The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5804Nov 4, 2012
Ubercart
Ubercart
risk 0.00cvss —epss 0.01
The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5803Nov 4, 2012
Ubercart
Ubercart
risk 0.00cvss —epss 0.01
The Authorize.Net module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5802Nov 4, 2012
Ubercart
Ubercart
risk 0.00cvss —epss 0.01
The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5801Nov 4, 2012
Prestashop
Prestashop
risk 0.00cvss —epss 0.01
The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate,…
CVE-2012-5800Nov 4, 2012
Prestashop
Prestashop
risk 0.00cvss —epss 0.01
The eBay module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5799Nov 4, 2012
Prestashop
Prestashop
risk 0.00cvss —epss 0.01
The Canada Post (aka CanadaPost) module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5798Nov 4, 2012
OsCommerce
Oscommerce
risk 0.00cvss —epss 0.01
The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5797Nov 4, 2012
OsCommerce
Oscommerce
risk 0.00cvss —epss 0.01
The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5796Nov 4, 2012
OsCommerce
Oscommerce
risk 0.00cvss —epss 0.01
The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5795Nov 4, 2012
OsCommerce
Oscommerce
risk 0.00cvss —epss 0.01
The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5794Nov 4, 2012
OsCommerce
Oscommerce
risk 0.00cvss —epss 0.01
The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5793Nov 4, 2012
OsCommerce
Oscommerce
risk 0.00cvss —epss 0.01
The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5792Nov 4, 2012
OsCommerce
Oscommerce
risk 0.00cvss —epss 0.01
The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5791Nov 4, 2012
Paypal
Invoicing
risk 0.00cvss —epss 0.01
PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5790Nov 4, 2012
Paypal
Payments Standard
risk 0.00cvss —epss 0.01
PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5789Nov 4, 2012
Paypal
Payments Standard
risk 0.00cvss —epss 0.01
PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5788Nov 4, 2012
Paypal
Ipn
risk 0.00cvss —epss 0.01
The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to…
CVE-2012-5787Nov 4, 2012
Paypal
Merchant Sdk PHP
risk 0.00cvss —epss 0.01
The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5786Nov 4, 2012
Apache
Cxf
risk 0.00cvss —epss 0.01
The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate,…
CVE-2012-5785Nov 4, 2012
Apache
Axis2
risk 0.00cvss —epss 0.02
Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5784Nov 4, 2012
Apache
Axis
risk 0.00cvss —epss 0.06
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's…
CVE-2012-5783Nov 4, 2012
Apache
Httpclient
risk 0.01cvss —epss 0.09
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…
CVE-2012-5782Nov 4, 2012
Amazon
Flexible Payments Service
risk 0.00cvss —epss 0.01
Amazon Flexible Payments Service (FPS) PHP Library does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary…
CVE-2012-5781Nov 4, 2012
Amazon
Elastic Load Balancing
risk 0.00cvss —epss 0.01
Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid…
CVE-2012-5780Nov 4, 2012
Amazon
Merchant SDK
risk 0.00cvss —epss 0.01
The Amazon merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-3446MedNov 4, 2012
Apache
Libcloud
risk 0.31cvss 5.9epss 0.01
Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL…
CVE-2012-5170Nov 4, 2012
Simon Brown
Pebble
risk 0.00cvss —epss 0.01
Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2012-4987Nov 4, 2012
RealNetworks
Realplayer
risk 0.00cvss —epss 0.03
Stack-based buffer overflow in RealNetworks RealPlayer 15.0.5.109 allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP file that triggers incorrect processing of long pathnames by the Watch Folders feature.
CVE-2012-3750Nov 3, 2012
Apple Inc.
iOS
risk 0.00cvss —epss 0.00
The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors.
CVE-2012-3749Nov 3, 2012
Apple Inc.
iOS
risk 0.00cvss —epss 0.02
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
CVE-2012-3748Nov 3, 2012
Apple Inc.
Safari
risk 0.04cvss —epss 0.17
Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.
CVE-2012-0025Nov 2, 2012
IrfanView
Flashpix Plugin
risk 0.04cvss —epss 0.06
Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the FlashPix PlugIn 4.2.2.0 for IrfanView, allows remote attackers to cause a denial of service (crash) via a crafted FPX image.