CVE-2020-25169

The CVE-2020-25169 issue affects Reolink P2P cameras, where data transferred between the local device and Reolink servers may be exposed due to cleartext transmission of sensitive information. The advisory notes a high risk with CVSS v3 base score up to 9.1 (ATT&CK context not explicitly listed i...

CVE-2020-28912

CVE-2020-28912 concerns MariaDB running on Windows where local clients connecting via named pipes can be intercepted by an unprivileged user who can then act as a man‑in‑the‑middle. The root cause is an incorrect security descriptor. Affects MariaDB Server before 10.1.48, 10.2.x before 10.2.35, 1...

CVE-2020-28912

With MariaDB running on Windows, when local clients connect to the server over named pipes, it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle, gaining access to all the data passed between...

CmtViewer Encryption

The vulnerability of the CmtViewer application for controlling programmable panels is related to the use of a less secure encryption algorithm. Exploiting this vulnerability allows a malicious actor, operating remotely, to intercept the data transmitted over the network, decrypt it, and gain full...

CVE-2020-35584

The vulnerability affects Solstice Pod prior to version 3.0.3. The web services expose a Browser Look‑in feature that allows connections over unencrypted channels. An attacker positioned to observe legitimate user network traffic could monitor interactions with the web services and capture sensit...

New 5G Network Flaws Let Attackers Track Users' Locations and Steal Data

As 5G networks are being gradually rolled out in major cities across the world, an analysis of its network architecture has revealed a number of potential weaknesses that could be exploited to carry out a slew of cyber assaults, including denial-of-service DoS attacks to deprive subscribers of...

New 5G Network Flaws Let Attackers Track Users' Locations and Steal Data

As 5G networks are being gradually rolled out in major cities across the world, an analysis of its network architecture has revealed a number of potential weaknesses that could be exploited to carry out a slew of cyber assaults, including denial-of-service DoS attacks to deprive subscribers of...

CVE-2020-25748

A Cleartext Transmission issue was discovered on Rubetek RV-3406, RV-3409, and RV-3411 cameras firmware versions v342, v339. Someone in the middle can intercept and modify the video data from the camera, which is transmitted in an unencrypted form. One can also modify responses from NTP and RTSP...

PT-2020-6276

Name of the Vulnerable Software and Affected Versions Rubetek RV-3406, RV-3409, and RV-3411 cameras firmware versions v342, v339 Description A Cleartext Transmission issue allows an attacker to intercept and modify video data from the camera, as it is transmitted in an unencrypted form. The...

CVE-2019-5591

A Default Configuration vulnerability in FortiOS may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the LDAP server...

23% of Tor browser relays found to be stealing Bitcoin

By Sudais Asif The threat actor was able to see the user's transmitted data on the Tor browser and tamper with it for their own ill-motives. This is a post from HackRead.com Read the original post: 23% of Tor browser relays found to be stealing Bitcoin...

Design/Logic Flaw

A vulnerability has been identified in SIMATIC HMI Basic Panels 1st Generation incl. SIPLUS variants All versions, SIMATIC HMI Basic Panels 2nd Generation incl. SIPLUS variants All versions, SIMATIC HMI Comfort Panels incl. SIPLUS variants All versions, SIMATIC HMI KTP700F Mobile Arctic All...

F5 NGINX Controller Trust Management Issues Vulnerability (CNVD-2021-18398)

F5 NGINX Controller is a centralized monitoring and management platform for NGINX from F5. The platform supports the management of multiple NGINX instances using a visual interface. A security vulnerability exists in F5 NGINX Controller versions 1.0.1, 2.0.0 through 2.9.0, and 3.0.0 through 3.5.0...

CVE-2020-5367

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an improper certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this...

CVE-2020-5367

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an improper certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this...

CVE-2020-5869: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

In BIG-IQ 5.2.0-7.0.0, high availability HA synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit...

Balt-System NC series Data Transmission Disclosure

The vulnerability of the embedded software in Balt-System NC series numerical control systems is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to intercept traffic and disclose confidential information...

MonitorMinor: vicious stalkerware?

Updated March 17th, 2020 The other day, our Android traps ensnared an interesting specimen of commercial software that is positioned as a parental control app, but may also be used to secretly monitor family members or colleagues – or, in other words, for stalking. Such apps are often called...

Crafty Web Skimming Domain Spoofs “https”

Earlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that one of its Web sites had been hacked and retrofitted with code that steals credit card and login data. While such Web site card skimming attacks are not new, this intrusion leveraged a sneaky new...

WAGO e!Cockpit Network Communication Plaintext Transfer Vulnerability

Cockpit is an interactive server management interface. A network communications plaintext transfer vulnerability exists in WAGO e!Cockpit, which can be exploited by an attacker to intercept, interpret, and manipulate data from or to e...