Man-in-the-middle spoofing of Twitter's servers in Tweepy allows attackers to intercept and modify API communications because the library fails to verify the X.509 certificate hostname. Exploitation requires the attacker to occupy a network intercept position (AC:H), but any application using an affected Tweepy release over HTTPS is exposed, leading to high confidentiality and integrity impact. A public proof-of-concept exists, and the vendor has released a patch; EPSS is low at 0.15%.
The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN). Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.