Most recent entries from all

EUVD-2026-109219

fkie_cve-2013-7398

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.

GHSA-5c66-6h6g-6q6m — Insufficient Verification of Data Authenticity in Async Http Client

Affected: Maven: com.ning:async-http-client

gsd-2013-7398

RHSA-2015:0850 — Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix WS: EJB3 role restrictions are not applied to jaxws handlers Java: Java XML Signature DoS Attack async-http-client: SSL/TLS certificate verification is disabled under certain conditions async-http-client: missing hostname verification for SSL certificates CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy JBossSX/PicketBox: World readable audit.log file CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods Security: Wrong security context loaded when using SAML2 STS Login Module RESTeasy: External entities expanded by DocumentProvider Weld: Limited information disclosure via stale thread state jBPM: BPMN2 file processing XXE in Process Execution