Viprinet Europe Multichannel VPN Router 300 Man-in-the-Middle Attack Vulnerability

Viprinet Europe Multichannel VPN Router 300 is a multichannel VPN router product from Viprinet Europe, Germany. A security vulnerability exists in the Viprinet Europe Multichannel VPN Router 300 that originates from the program failing to validate a certificate. An attacker could use this...

Unspecified Vulnerability in NTP

NTP is a network protocol that synchronizes the clocks of two computers by exchanging packets. NTP fails to check symmetric key correspondences when performing packet authentication, allowing a remote attacker to perform impersonation attacks with arbitrary trusted keys...

Chrony Impersonation Attack Vulnerability

chrony is a set of tools for maintaining the clock accuracy of computer systems. chrony fails to check symmetric key correspondences when performing packet authentication, allowing a remote attacker to perform impersonation attacks with arbitrary trusted keys...

CVE-2016-1567

chrony before 1.31.2 and 2.x before 2.2.1 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."...

CVE-2015-7974

NTP 4.x before 4.2.8p6 and 4.3.x before 4.3.90 do not verify peer associations of symmetric keys when authenticating packets, which might allow remote attackers to conduct impersonation attacks via an arbitrary trusted key, aka a "skeleton key."...

CVE-2015-7974

CVE-2015-7974 concerns the NTP reference implementation. The issue arises when authenticated packets are processed: symmetric-key peer associations are not properly verified, potentially enabling a remote attacker to impersonate a trusted peer (skeleton key). Affected are NTP 4.x prior to 4.2.8p6...

Critical iOS Flaw allowed Hackers to Steal Cookies from Devices

Apple has patched a critical vulnerability in its iOS operating system that allowed criminal hackers to impersonate end users' identities by granting read/write access to website's unencrypted authentication cookies. The vulnerability was fixed with the release of iOS 9.2.1 on Tuesday, almost thr...

AIX OpenSSH Advisory : openssh_advisory6.asc

The remote AIX host has a version of OpenSSH installed that is affected by the following vulnerabilities : - A flaw exists in the monitor component when handling extraneous username data in MONITORREQPAMINITCTX requests. A local attacker can exploit this issue to conduct an impersonation attack, ...

pcs: Incorrect authorization when using pcs web UI

A race condition was found in the way the pcsd web UI backend performed authorization of user requests. An attacker could use this flaw to send a request that would be evaluated as originating from a different user, potentially allowing the attacker to perform actions with permissions of a more...

UBUNTU-CVE-2015-6563

The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITORREQPAMINITCTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafte...

CVE-2015-6563

The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITORREQPAMINITCTX requests, which allows local users to conduct impersonation attacks by leveraging any SSH login access in conjunction with control of the sshd uid to send a crafte...

CVE-2015-4316

CVE-2015-4316 affects Cisco TelePresence Video Communication Server Expressway X8.5.2, specifically the Mobile and Remote Access (MRA) endpoint-validation feature. The issue is improper validation of the registering phone line, enabling an authenticated remote attacker to impersonate legitimate u...

Yodobashi Camera Yodobashi for Android Security Bypass Vulnerability

Yodobashi Camera Yodobashi for Android is a large-scale Android-based chain shopping website by Yodobashi Camera, which sells a wide range of household electrical appliances, computers, cosmetics and designer bags. A security bypass vulnerability exists in Yodobashi Camera Yodobashi for Android. ...

Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted Names Evaluation

It was found that PKIX trust components allowed an X.509 credential to be trusted if no trusted names were available for the entityID. An attacker could use a certificate issued by a shibmd:KeyAuthority trust anchor to impersonate an entity within the scope of that keyAuthority...

DEBIAN-CVE-2015-3143

cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015...

krb5: kadmind incorrectly validates server principal name (MITKRB5-SA-2015-001)

It was found that the MIT Kerberos administration server kadmind incorrectly accepted certain authentication requests for two-component server principal names. A remote attacker able to acquire a key with a particularly named principal such as "kad/x" could use this flaw to impersonate any user t...

Python rhn-setup Security Bypass Vulnerability

Python rhn-setup is a Python package. A security bypass vulnerability exists in Python rhn-setup. An attacker can exploit this vulnerability to conduct a man-in-the-middle attack and impersonate a trusted server...

Internet Bug Bounty: FREAK: Factoring RSA_EXPORT Keys to Impersonate TLS Servers

Many TLS servers, including those hosting sensitive websites such as www.nsa.gov and connect.facebook.net, support weak EXPORTRSA ciphersuites. By factoring their 512-bit ephemeral RSA keys, a network attacker is able to impersonate these websites to web browsers and more generally, to client...

Slackware: Security Advisory (SSA:2009-218-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2011-1428

Wee Enhanced Environment for Chat aka WeeChat 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect...