CVE-2014-0363

The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.

• CWE-295

• http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-releasedVendor Advisory
• http://issues.igniterealtime.org/browse/SMACK-410Issue Tracking, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1176.htmlThird Party Advisory
• http://secunia.com/advisories/59290Third Party Advisory
• http://secunia.com/advisories/59291Third Party Advisory
• http://www.kb.cert.org/vuls/id/489228Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/67119Third Party Advisory, VDB Entry
• http://community.igniterealtime.org/blogs/ignite/2014/04/17/asmack-400-rc1-has-been-releasedVendor Advisory
• http://issues.igniterealtime.org/browse/SMACK-410Issue Tracking, Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-1176.htmlThird Party Advisory
• http://secunia.com/advisories/59290Third Party Advisory
• http://secunia.com/advisories/59291Third Party Advisory
• http://www.kb.cert.org/vuls/id/489228Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/67119Third Party Advisory, VDB Entry

Published

Apr 30, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0357Amtelco miSecureMessages allows remote attackers to read the…
• CVE-2014-0358Multiple directory traversal vulnerabilities in Xangati XSR …
• CVE-2014-0359Xangati XSR before 11 and XNR before 7 allows remote attacke…
• CVE-2014-0360Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0361The default configuration of IBM 4690 OS, as used in Toshiba…
• CVE-2014-0362Cross-site scripting (XSS) vulnerability on Google Search Ap…
• CVE-2014-0364The ParseRoster component in the Ignite Realtime Smack XMPP …
• CVE-2014-0366Unspecified vulnerability in the Oracle Applications Framewo…
• CVE-2014-0367Unspecified vulnerability in the Hyperion Essbase Administra…
• CVE-2014-0368Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, an…
• CVE-2014-0369Unspecified vulnerability in the Siebel Core - EAI component…
• CVE-2014-0370Unspecified vulnerability in the Siebel Life Sciences compon…