deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-3749
Published: 2012-11-03
Description: The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0012.html; http://lists.apple.com/archives/security-announce/2012/Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
CVE: CVE-2012-3750
Published: 2012-11-03
Description: The Passcode Lock implementation in Apple iOS before 6.0.1 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement and access Passbook passes via unspecified vectors.
CVSS Score: 3.6 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0012.html; http://lists.apple.com/archives/security-announce/2012/Nov/msg00000.html; http://support.apple.com/kb/HT5567
CVE: CVE-2012-4987
Published: 2012-11-04
Description: Stack-based buffer overflow in RealNetworks RealPlayer 15.0.5.109 allows user-assisted remote attackers to execute arbitrary code via a crafted ZIP file that triggers incorrect processing of long pathnames by the Watch Folders feature.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/86721; http://packetstormsecurity.org/files/117691/Realplayer-Watchfolders-Long-Filepath-Overflow.html; http://seclists.org/fulldisclosure/2012/Oct/189
CVE: CVE-2012-5170
Published: 2012-11-04
Description: Open redirect vulnerability in Pebble before 2.6.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN55398821/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000100; http://osvdb.org/86890
CVE: CVE-2012-3446
Published: 2012-11-04
Description: Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://svn.apache.org/repos/asf/libcloud/trunk/CHANGES; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5780
Published: 2012-11-04
Description: The Amazon merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/51196; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://secunia.com/advisories/51196
CVE: CVE-2012-5781
Published: 2012-11-04
Description: Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to overriding the default JDK X509TrustManager.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5782
Published: 2012-11-04
Description: Amazon Flexible Payments Service (FPS) PHP Library does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to misinterpretation of a certain "true" value.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79985; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5783
Published: 2012-11-04
Description: Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-295
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00078.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00040.html; http://lists.opensuse.org/opensuse-updates/2013-04/msg00041.html
CVE: CVE-2012-5784
Published: 2012-11-04
Description: Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00007.html; http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00022.html; http://rhn.redhat.com/errata/RHSA-2013-0269.html
CVE: CVE-2012-5785
Published: 2012-11-04
Description: Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/51219; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.securityfocus.com/bid/56408
CVE: CVE-2012-5786
Published: 2012-11-04
Description: The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. NOTE: The vendor states that the sample had specifically used a flag to bypass the DN check
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79983; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5787
Published: 2012-11-04
Description: The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/51184; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.securityfocus.com/bid/56445
CVE: CVE-2012-5788
Published: 2012-11-04
Description: The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79982; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5789
Published: 2012-11-04
Description: PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to intentional disabling of certificate-validation checks through a "FALSE" value.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79912; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5790
Published: 2012-11-04
Description: PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to misinterpretation of a certain TRUE value.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79981; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5791
Published: 2012-11-04
Description: PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79980; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5792
Published: 2012-11-04
Description: The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79979; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5793
Published: 2012-11-04
Description: The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79978; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5794
Published: 2012-11-04
Description: The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79957; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5795
Published: 2012-11-04
Description: The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79956; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5796
Published: 2012-11-04
Description: The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79955; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5797
Published: 2012-11-04
Description: The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79954; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5798
Published: 2012-11-04
Description: The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5799
Published: 2012-11-04
Description: The Canada Post (aka CanadaPost) module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5800
Published: 2012-11-04
Description: The eBay module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79951; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5801
Published: 2012-11-04
Description: The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5802
Published: 2012-11-04
Description: The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79949; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5803
Published: 2012-11-04
Description: The Authorize.Net module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79948; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5804
Published: 2012-11-04
Description: The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79947; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5805
Published: 2012-11-04
Description: The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, a different vulnerability than CVE-2012-5806.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5806
Published: 2012-11-04
Description: The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the PHP fsockopen function, a different vulnerability than CVE-2012-5805.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5807
Published: 2012-11-04
Description: The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5808
Published: 2012-11-04
Description: The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5809
Published: 2012-11-04
Description: The Groupon Redemptions application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5810
Published: 2012-11-04
Description: The Chase mobile banking application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to overriding the default X509TrustManager. NOTE: this vulnerability was fixed in the summer of 2012, but the version number was not changed or is not known.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-295
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://docs.google.com/document/pub?id=1roBIeSJsYq3Ntpf6N0PIeeAAvu4ddn7mGo6Qb7aL7ew; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5811
Published: 2012-11-04
Description: The Breezy application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5812
Published: 2012-11-04
Description: The ACRA library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79939; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5813
Published: 2012-11-04
Description: The Android_Pusher library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79938; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5814
Published: 2012-11-04
Description: Weberknecht, as used in GitHub Gaug.es and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79937; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5815
Published: 2012-11-04
Description: The Rackspace app 2.1.5 for iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79936; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5816
Published: 2012-11-04
Description: AOL Instant Messenger (AIM) 1.0.1.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79935; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5817
Published: 2012-11-04
Description: Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 7.4 (HIGH)
CWE: CWE-295
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79934; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
CVE: CVE-2012-5818
Published: 2012-11-04
Description: ElephantDrive does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf; https://exchange.xforce.ibmcloud.com/vulnerabilities/79933; http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf