CVE-2017-8154

The CVE-2017-8154 entry concerns Huawei/Honor devices (Themes App on Honor 8 Lite) with software versions prior to Prague-L31C576B172, Prague-L31C530B160, and Prague-L31C432B180. The underlying issue is an MITM vulnerability arising from the use of insecure HTTP to download themes, enabling an at...

Huawei Honor 8 Youth Man-in-the-Middle Attack Vulnerability

Huawei Honor 8 Youth is a smartphone device. A man-in-the-middle attack vulnerability exists in Huawei Honor 8 Youth Edition. Since the theme manager uses an insecure http protocol to download certain theme packages, an attacker may exploit this vulnerability to corrupt the downloaded theme...

CoolMusicBox Upgrade Process Involves Arbitrary File Download Vulnerability

Coolmusic is a one-stop personalized music service platform that integrates music discovery, access and enjoyment. There is an arbitrary file download vulnerability in the update process of kwmusic, due to the use of insecure HTTP communication protocol to interact with the server, and did not...

CVE-2011-2683

reseed seeds random numbers from an insecure HTTP request to random.org during installation, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a man-in-the-middle attack...

SolarWinds Log and Event Manager < 6.3.1 Hotfix 4 Insecure HTTP Update Download MitM Code Execution

According to its self-reported version number, the SolarWinds Log and Event Manager installed on the remote host is prior to version 6.3.1 Hotfix 4. It is, therefore, affected by a vulnerability in the software update process. Software updates are packaged and delivered insecurely, leading to roo...

Apache OpenMeetings < 3.3.0 Multiple Vulnerabilities

Apache OpenMeetings is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:openmeetings";...

CVE-2017-7685

Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...

CVE-2017-7685

Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH...

CVE-2017-8894

AeroAdmin 4.1 uses an insecure protocol HTTP to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code in the machine...

CVE-2017-3219

Acronis True Image up to and including version 2017 Build 8053 performs software updates using HTTP. Downloaded updates are only verified using a server-provided MD5 hash...

CVE-2016-8230

In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model and product name to Lenovo's servers...

Hardcoded credentials

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

CVE-2016-8273

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

CVE-2016-8273

Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...

Design/Logic Flaw

The 1 update and 2 package-installation features in MODX Revolution 2.5.4-pl and earlier use http://rest.modx.com by default, which allows man-in-the-middle attackers to spoof servers and trigger the execution of arbitrary code by leveraging the lack of the HTTPS protection mechanism...

Man In The Middle (MitM)

windows-build-tools is vulnerable to man-in-the-middle MitM attacks due to downloading installer packages over insecure http protocol. It may cause remote code execution RCE by swapping out the requested package with an attacker controlled package if the attacker is on the network or positioned i...

Man-in-the-Middle (MitM)

pry-rescue is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the use of the deprecated :rubygems option in the Gemfile, causing insecure HTTP requests to be made. A malicious user can potentially compromise the download to conduct MitM attacks...

Man-in-the-Middle (MitM)

maildir is vulnerable to man-in-the-middle MitM attacks. The rubygems source uses insecure http, meaning a malicious user can potentially compromise the source to conduct a Man-in-the-Middle attack...

Downloads Resources over HTTP

Overview Affected versions of serc.js insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on t...

Downloads Resources over HTTP

Overview Affected versions of ibapi insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the...