https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:59:28 +0000 https://cve.radiocsirt.org/vuln/cnvd-2015-03333 cnvd-2015-03333 https://cve.radiocsirt.org/vuln/cnvd-2015-03333 https://cve.radiocsirt.org/vuln/euvd-2026-109224 EUVD-2026-109224 https://cve.radiocsirt.org/vuln/euvd-2026-109224 https://cve.radiocsirt.org/vuln/fkie_cve-2013-7397 <p>Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.</p> <p>Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2013-7397 https://cve.radiocsirt.org/vuln/ghsa-8h53-fjgg-g42g <p><strong>Affected:</strong> Maven: com.ning:async-http-client</p> <p>Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.</p> <p><strong>Affected:</strong> Maven: com.ning:async-http-client</p> <p>Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.</p> https://cve.radiocsirt.org/vuln/ghsa-8h53-fjgg-g42g https://cve.radiocsirt.org/vuln/gsd-2013-7397 gsd-2013-7397 https://cve.radiocsirt.org/vuln/gsd-2013-7397 https://cve.radiocsirt.org/vuln/rhsa-2015:0850 <p>CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix WS: EJB3 role restrictions are not applied to jaxws handlers Java: Java XML Signature DoS Attack async-http-client: SSL/TLS certificate verification is disabled under certain conditions async-http-client: missing hostname verification for SSL certificates CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy JBossSX/PicketBox: World readable audit.log file CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods Security: Wrong security context loaded when using SAML2 STS Login Module RESTeasy: External entities expanded by DocumentProvider Weld: Limited information disclosure via stale thread state jBPM: BPMN2 file processing XXE in Process Execution</p> <p>CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix WS: EJB3 role restrictions are not applied to jaxws handlers Java: Java XML Signature DoS Attack async-http-client: SSL/TLS certificate verification is disabled under certain conditions async-http-client: missing hostname verification for SSL certificates CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy JBossSX/PicketBox: World readable audit.log file CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods Security: Wrong security context loaded when using SAML2 STS Login Module RESTeasy: External entities expanded by DocumentProvider Weld: Limited information disclosure via stale thread state jBPM: BPMN2 file processing XXE in Process Execution</p> https://cve.radiocsirt.org/vuln/rhsa-2015:0850 https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-7397 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: async-http-client</p> <p>Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: async-http-client</p> <p>Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2013-7397