CVE-2011-1428

MediumCVSS 5.8/10Last modified Jun 16, 2026

Description

Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect use of the GnuTLS API.

Metrics

CVSS 2.0 5.8/10AV:N/AC:M/Au:N/C:P/I:P/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-14295.8Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-CVE-2011-14306.8The STARTTLS implementation in the server in Ipswitch IMail 11.03 and earlier does not properly restrict I/O buffering, which allows man-in-CVE-2011-14316.8The STARTTLS implementation in qmail-smtpd.c in qmail-smtpd in the netqmail-1.06-tls patch for netqmail 1.06 does not properly restrict I/O CVE-2011-14326.8The STARTTLS implementation in SCO SCOoffice Server does not properly restrict I/O buffering, which allows man-in-the-middle attackers to in CVE-2011-14335.0The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials in CVE-2011-14346.8Google Chrome before 11.0.696.57 does not ensure thread safety during handling of MIME data, which allows remote attackers to cause a denial CVE-2011-14355.0Google Chrome before 11.0.696.57 does not properly implement the tabs permission for extensions, which allows remote attackers to read local CVE-2011-14365.0Google Chrome before 11.0.696.57 on Linux does not properly interact with the X Window System, which allows remote attackers to cause a deni CVE-2011-14376.8Multiple integer overflows in Google Chrome before 11.0.696.57 allow remote attackers to cause a denial of service or possibly have unspecif CVE-2011-14387.5Google Chrome before 11.0.696.57 allows remote attackers to bypass the Same Origin Policy via vectors involving blobs.CVE-2011-14396.8Google Chrome before 11.0.696.57 on Linux does not properly isolate renderer processes, which has unspecified impact and remote attack vecto CVE-2011-14406.8Use-after-free vulnerability in Google Chrome before 11.0.696.57 allows remote attackers to cause a denial of service or possibly have unspe