CVE-2018-4015

HIGH Year: 2018
CVSS v3 Score
8.1
High
CVSS v2 Score
6.8
Medium
Weakness Type
CWE-295
View all →

Vulnerability Description

An exploitable vulnerability exists in the HTTP client functionality of the Webroot BrightCloud SDK. The configuration of the HTTP client does not enforce a secure connection by default, resulting in a failure to validate TLS certificates. An attacker could impersonate a remote BrightCloud server to exploit this vulnerability.

Related Vulnerabilities

CVE-2015-2318

HIGH
CVSS:8.1(High)

The TLS stack in Mono before 3.12.1 allows man-in-the-middle attackers to conduct message skipping attacks and consequently impersonate clients by leveraging missing handshake state validation, aka a ...

CWE-2952015

CVE-2015-5263

HIGH
CVSS:8.1(High)

pulp-consumer-client 2.4.0 through 2.6.3 does not check the server's TLS certificate signatures when retrieving the server's public key upon registration.

CWE-2952015

CVE-2015-8960

HIGH
CVSS:8.1(High)

The TLS protocol 1.2 and earlier supports the rsa_fixed_dh, dss_fixed_dh, rsa_fixed_ecdh, and ecdsa_fixed_ecdh values for ClientCertificateType but does not directly document the ability to compute th...

CWE-2952015

CVE-2016-10931

HIGH
CVSS:8.1(High)

An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostn...

CWE-2952016

CVE-2016-1148

HIGH
CVSS:8.1(High)

Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.

CWE-2952016

CVE-2016-7075

HIGH
CVSS:8.1(High)

It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authenticati...

CWE-2952016