Gizmo does not check SSL certificate before sending user credentials. An attacker is able to obtain username and password with a spoofed certificate and no alert is generated to the user. This vulnerability was found in Gizmo for Linux 3.1.0.79. Other versions may also be affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/78683/gizmo-ssl.txt
Source: https://packetstormsecurity.com/files/78683/Gizmo-SSL-Certificate-Vulnerability.html