3451 matches found
DEBIAN-CVE-2019-25031
Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contributed script from the...
SUSE: Security Advisory (SUSE-SU-2021:0241-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-7308
Cleartext Transmission of Sensitive Information between McAfee Endpoint Security ENS for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence GTI servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining...
Design/Logic Flaw
Cleartext Transmission of Sensitive Information between McAfee Endpoint Security ENS for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence GTI servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining...
CVE-2020-7308 Transmission of data in clear text by McAfee ENS
Cleartext Transmission of Sensitive Information between McAfee Endpoint Security ENS for Windows prior to 10.7.0 February 2021 Update and McAfee Global Threat Intelligence GTI servers using DNS allows a remote attacker to view the requests from ENS and responses from GTI over DNS. By gaining...
mongodb-client-encryption vulnerable to Improper Certificate Validation
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...
GHSA-RJMF-P882-645M mongodb-client-encryption vulnerable to Improper Certificate Validation
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...
GHSA-GFR2-QPXH-QJ9M Path Traversal in Ansible
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable...
CVE-2021-27899
The Proofpoint Insider Threat Management Agents formerly ObserveIT Agent for MacOS and Linux perform improper validation of the ITM Server's certificate, which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are...
VulnCheck KEV: CVE-2019-5591
Fortinet FortiOS contains a default configuration vulnerability that may allow an unauthenticated attacker on the same subnet to intercept sensitive information by impersonating the Lightweight Directory Access Protocol LDAP server...
Samsung Cloud Hijacking Vulnerability
Samsung Cloud is an application from the South Korean company Samsung Samsung. It is used to provide a function to save and view pictures. A security vulnerability exists in Samsung Cloud prior to version 4.7.0.3 that allows an attacker to intercept the provider when it is executed. No details of...
CURL-CVE-2021-22890 TLS 1.3 session ticket proxy host mix-up
Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using an HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they arrived from the remote serve...
The vulnerability of the Cisco Jabber for Windows software platform, related to insufficient certification verification, allows a malicious actor to intercept network requests from the vulnerable software and provide maliciously created certificates.
The vulnerability of the Cisco Jabber for Windows software platform is related to insufficient certification verification. Exploiting this vulnerability allows a malicious actor to intercept network requests from the vulnerable software and provide maliciously created certificates...
Design/Logic Flaw
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 28.08.06.1 contains the administrator account password in plaintext. The page can be intercepted on HTTP...
CVE-2021-28937
The /password.html page of the Web management interface of the Acexy Wireless-N WiFi Repeater REV 1.0 28.08.06.1 contains the administrator account password in plaintext. The page can be intercepted on HTTP...
CVE-2021-28937
Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to a password disclosure through its web management interface. The NUCLEI template for CVE-2021-28937 notes that the /password.html page stores the administrator password in plaintext and can be intercepted over HTTP, enabling potential access ...
Amazon Acexy Wireless-N WiFi Repeater REV 安全漏洞
Amazon Acexy Wireless-N WiFi Repeater REV is an Amazon.com, Inc. It is used to provide network services A security vulnerability exists in Acexy Wireless-N WiFi Repeater REV 1.0, which originates from a plaintext password containing the administrator account. It is possible to intercept the page ...
CVE-2021-25368
Hijacking vulnerability in Samsung Cloud prior to version 4.7.0.3 allows attackers to intercept when the provider is executed...