Most recent entries from all

cnvd-2016-05963

fkie_cve-2016-5672

GHSA-hv57-2phm-3w47

gsd-2016-5672

VAR-201608-0085

Intel Crosswalk before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 interprets a user's acceptance of one invalid X.509 certificate to mean that all invalid X.509 certificates should be accepted without prompting, which makes it easier for man-in-the-middle attackers to spoof SSL servers and obtain sensitive information via a crafted certificate. Intel Crosswalk Project Is Android and iOS A framework for developing hybrid apps Crosswalk Project Is illegal SSL There is a problem in the processing when the user accepts the server certificate, and the application SSL Validation of all server certificates may be hindered. Issue that does not warn the user that the operation is unsafe (CWE-356) - CVE-2016-5672 Fraudulent SSL If a server certificate is detected, Crosswalk Project Apps created using show an error message. The user gets this error message "OK" If you select, the app SSL Server certificate verification will not be performed. The error message indicates that the app is permanently SSL It is not clearly stated that the server certificate will no longer be verified, and the same message will not be displayed again. CWE-356: Product UI does not Warn User of Unsafe Actions http://cwe.mitre.org/data/definitions/356.html Researchers are releasing more detailed information as security advisories. Also, Intel Corporation Has also created a blog post about this issue. Security advisory https://wwws.nightwatchcybersecurity.com/2016…