CWE-295

{
  "affected": [],
  "aliases": [
    "CVE-2025-0239"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-07T16:15:38Z",
    "severity": "MODERATE"
  },
  "details": "When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability affects Firefox \u003c 134 and Firefox ESR \u003c 128.6.",
  "id": "GHSA-p4q7-g7ff-823j",
  "modified": "2025-11-04T00:32:15Z",
  "published": "2025-01-07T18:30:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0239"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1929156"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-01"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-02"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-04"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2025-05"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-11550"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-05-08T17:29:00Z",
    "severity": "MODERATE"
  },
  "details": "Citrix SD-WAN 10.2.x before 10.2.1 and NetScaler SD-WAN 10.0.x before 10.0.7 have Improper Certificate Validation.",
  "id": "GHSA-p53g-mf4j-5xxx",
  "modified": "2024-04-04T00:33:23Z",
  "published": "2022-05-24T16:45:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11550"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/article/CTX247735"
    },
    {
      "type": "WEB",
      "url": "https://support.citrix.com/v1/search?searchQuery=%22%22\u0026lang=en\u0026sort=cr_date_desc\u0026prod=\u0026pver=\u0026ct=Security+Bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-4948"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-11-14T12:30:00Z",
    "severity": "MODERATE"
  },
  "details": "The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers\u0027 installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.",
  "id": "GHSA-p5m6-f3fp-3v88",
  "modified": "2022-05-17T03:27:30Z",
  "published": "2022-05-17T03:27:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4948"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/87048"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/111708"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/56382"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "matrix-sydent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.5.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-38686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-31T22:03:44Z",
    "nvd_published_at": "2023-08-04T16:15:10Z",
    "severity": "CRITICAL"
  },
  "details": "## Impact\n\nIf configured to send emails using TLS, Sydent does not verify SMTP servers\u0027 certificates. This makes  Sydent\u0027s emails vulnerable to interception via a [man-in-the-middle (MITM) attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack). Attackers with privileged access to the network can intercept room invitations and address confirmation emails.\n\nCVSS 3.1 overall score: 3.3 - [AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/CR:L/IR:L/AR:X/MAV:A/MAC:H/MPR:N/MUI:N/MS:C/MC:L/MI:L/MA:N](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/CR:L/IR:L/AR:X/MAV:A/MAC:H/MPR:N/MUI:N/MS:C/MC:L/MI:L/MA:N\u0026version=3.1)\n\n_Reported by Martin Schobert, [Pentagrid AG](https://pentagrid.ch/)._\n\n### Details\n\nSydent can be configured to send emails over a TLS-encrypted socket by setting\n\n```yaml\nemail:\n    tlsmode: \"TLS\"  # or the legacy value \"SSL\"\n```\n\nin its config file. Alternatively it can be configured to use [Opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) by setting\n\n```yaml\nemail:\n    tlsmode: \"STARTTLS\"\n```\n\nIn both situations, Sydent will encrypt its communication with the SMTP server when sending emails. **In affected versions, Sydent will not verify the destination server\u0027s certificate.**\n\n### Vulnerability \n\nSydent sends email for two purposes:\n- to inform a third party that they have been invited to a Matrix room by their email address; and\n- to verify that a given Matrix user controls an email address.\n\nTherefore, attackers capable of running a MITM attack can\n\n1. Intercept room invitations sent to an email address. The invitation includes \n   - the room ID and its avatar, and\n   - the inviter\u0027s username, displayname and their avatar, and\n   - credentials for a guest Matrix account on the inviter\u0027s homeserver.\n2. Intercept address ownership confirmation emails. This would allow the attacker to falsely claim ownership of the indented recipient\u0027s Matrix account, if that account was permitted to log in using an email address and no other authentication factors.\n\n\n### Patches\n\nThis is patched in [Sydent 2.5.6](https://github.com/matrix-org/sydent/releases/tag/v2.5.6), see PR https://github.com/matrix-org/sydent/pull/574.\n\nWhen patching, make sure that Sydent trusts the certificate of the server it is connecting to. This should happen automatically when using properly issued certificates. If you are using self-signed certificates, make sure to copy your Certification Authority certificate, or your self signed certificate if using only one, to the trust store of your operating system.\n\n### Workarounds\n\nOne can ensure Sydent\u0027s emails fail to send by setting the configured SMTP server to a loopback or [non-routable](https://datatracker.ietf.org/doc/html/rfc1918#section-3) address under your control which does not have a listening SMTP server. For example:\n\n```yaml\nemail:\n    smtphost: \"localhost\"  # Assuming there is no SMTP server listening on localhost\n```\n\n### References\n\n- https://github.com/matrix-org/sydent/pull/574 implements the fix.\n- https://github.com/matrix-org/sydent/releases/tag/v2.5.6 is the release including this fix.\n- https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations details the best-practice advice on how to use the standard library `smtp` module safely.\n- https://peps.python.org/pep-0476/ (accepted) proposed enabling TLS certificate verification by default  in standard library HTTP clients.\n- https://github.com/python/cpython/issues/91826 discusses enabling TLS certificate verification by default in the Python standard library, for SMTP and other protocols.\n\n## For more information\n\nIf you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).",
  "id": "GHSA-p6hw-wm59-3g5g",
  "modified": "2023-08-04T18:41:16Z",
  "published": "2023-07-31T22:03:44Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/security/advisories/GHSA-p6hw-wm59-3g5g"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38686"
    },
    {
      "type": "WEB",
      "url": "https://github.com/python/cpython/issues/91826"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/pull/574"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/commit/1cd748307c6b168b66154e6c4db715d4b9551261"
    },
    {
      "type": "WEB",
      "url": "https://docs.python.org/3/library/ssl.html?highlight=ssl#security-considerations"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/matrix-org/sydent"
    },
    {
      "type": "WEB",
      "url": "https://github.com/matrix-org/sydent/releases/tag/v2.5.6"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-sydent/PYSEC-2023-139.yaml"
    },
    {
      "type": "WEB",
      "url": "https://peps.python.org/pep-0476"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sydent does not verify email server certificates"
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-2902"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-11-21T23:15:00Z",
    "severity": "HIGH"
  },
  "details": "wolfssl before 3.2.0 does not properly authorize CA certificate for signing other certificates.",
  "id": "GHSA-p6m7-449x-fvm9",
  "modified": "2024-04-03T23:59:19Z",
  "published": "2022-05-17T19:57:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2902"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792646"
    },
    {
      "type": "WEB",
      "url": "https://security-tracker.debian.org/tracker/CVE-2014-2902"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/04/18/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "twitter-stream"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-24392"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-19T19:21:49Z",
    "nvd_published_at": "2021-02-19T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In voloko twitter-stream 0.1.16, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).",
  "id": "GHSA-p6p8-q4pj-f74m",
  "modified": "2021-03-19T19:21:49Z",
  "published": "2021-03-29T16:28:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24392"
    },
    {
      "type": "WEB",
      "url": "https://github.com/voloko/twitter-stream"
    },
    {
      "type": "ADVISORY",
      "url": "https://securitylab.github.com/advisories/GHSL-2020-097-voloko-twitter-stream"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Certificate Validation in twitter-stream"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-11176"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-787"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-09T07:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "While processing server certificate from IPSec server, certificate validation for subject alternative name API can cause heap overflow which can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile",
  "id": "GHSA-p75q-98c9-c3h5",
  "modified": "2022-05-24T19:04:42Z",
  "published": "2022-05-24T19:04:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11176"
    },
    {
      "type": "WEB",
      "url": "https://www.qualcomm.com/company/product-security/bulletins/june-2021-bulletin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-7922"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-09T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates are unaffected.",
  "id": "GHSA-p75r-f57h-pg5w",
  "modified": "2024-01-23T18:31:08Z",
  "published": "2022-05-24T17:13:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7922"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mongodb/mongodb-enterprise-kubernetes/releases/tag/1.2.5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-28807"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-31T20:15:44Z",
    "severity": "MODERATE"
  },
  "details": "In Zscaler Internet Access (ZIA) a mismatch between Connect Host and Client Hello\u0027s Server Name Indication (SNI) enables attackers to evade network security controls by hiding their communications within legitimate traffic.",
  "id": "GHSA-p774-6cp5-x7cj",
  "modified": "2024-01-31T21:31:03Z",
  "published": "2024-01-31T21:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28807"
    },
    {
      "type": "WEB",
      "url": "https://help.zscaler.com/zia/configuring-advanced-settings#dns-optimization"
    },
    {
      "type": "WEB",
      "url": "https://help.zscaler.com/zia/configuring-advanced-settings#domain-fronting"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.0.14"
      },
      "package": {
        "ecosystem": "npm",
        "name": "ezseed-transmission"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.10"
            },
            {
              "fixed": "0.0.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2016-1000224"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295",
      "CWE-300"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:11:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Affected versions of `ezseed-transmission` download and run a script over an HTTP connection.\n\nAn attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`.\n\n\n\n## Recommendation\n\nUpdate to version 0.0.15 or later.",
  "id": "GHSA-p788-rj37-357w",
  "modified": "2021-09-23T21:28:12Z",
  "published": "2020-09-01T15:26:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000224"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/npm:ezseed-transmission:20160729"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/114"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Insecure Defaults Leads to Potential MITM in ezseed-transmission"
}