Design/Logic Flaw

A vulnerability in the SSL implementation of the Cisco Intelligent Proximity solution could allow an unauthenticated, remote attacker to view or alter information shared on Cisco Webex video devices and Cisco collaboration endpoints if the products meet the conditions described in the Vulnerable...

CVE-2019-18863

A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. A successful exploit may allow the attacker to intercep...

PT-2020-9994

Name of the Vulnerable Software and Affected Versions: Mitel 6800 and 6900 SIP series phones versions 5.1.0.2051 SP2 and earlier Description: A key length issue in the SRTP 128-bit key implementation could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call,...

Webshell Bypass Vulnerability in Web Security Dog Apache Edition (CNVD-2020-23226)

Website Security Dog APACHE Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection functions to fully protect website security. Webshell bypass vulnerability exists in Website Security Dog Apache Edition, which can ...

Man-in-the-Middle (MitM)

jwebunit is vulnerable to man-in-the-middle attacks. The package uses an insecure HTTP channel to resolve package dependencies, allowing an attacker to intercept and modify network traffic or introduce malicious code into the resolved package...

Mac adware is more sophisticated and dangerous than traditional Mac malware

As the data revealed in our State of Malware report showed, Mac threats are on the rise, but they are not the same type of threats experienced by Windows users. Most notably, more traditional forms of malware, such as ransomware, spyware, and backdoors account for over 27 percent of all Windows...

Webshell Bypass Vulnerability in Web Security Dog (Apache Edition)

Website Security Dog APACHE Edition is a server tool that integrates website content security protection, website resource protection and website traffic protection functions to fully protect website security. Website Security Dog Apache Edition has a webshell bypass vulnerability that can be...

New LTE Network Flaw Could Let Attackers Impersonate 4G Mobile Users

A group of academics from Ruhr University Bochum and New York University Abu Dhabi have uncovered security flaws in 4G LTE and 5G networks that could potentially allow hackers to impersonate users on the network and even sign up for paid subscriptions on their behalf. The impersonation attack —...

Man-in-the-Middle (MitM)

jcommander is vulnerable to man-in-the-middle attacks. The usage of an insecure HTTP channel during build allows an attacker to intercept and modify network traffic and introduce malicious code into the third-party component...

Forcepoint WebSecurity 8.5 Cross Site Scripting

Exploit Title: Forcepoint WebSecurity 8.5 - Reflective Cross-Site Scripting Exploit Author: Prasenjit Kanti Paul Vendor Homepage: https://www.forcepoint.com/ Software Link: https://www.forcepoint.com/product/cloud-security/web-security Version: Forcepoint Web Security 8.5 Tested on: Windows 7,10...

Code injection

MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets...

CVE-2016-9928

MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets...

CVE-2016-9928

CVE-2016-9928 affects MCabber prior to 1.0.4. The vulnerability arises from improper handling of roster pushes in XMPP, allowing a remote attacker to intercept communications or add themselves as another user in a third party’s roster, potentially gaining privileges. Multiple advisories reference...

CVE-2016-9928

MCabber before 1.0.4 is vulnerable to roster push attacks, which allows remote attackers to intercept communications, or add themselves as an entity on a 3rd party's roster as another user, which will also garner associated privileges, via crafted XMPP packets...

CVE-2015-0102

IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

Session fixation

IBM Workflow for Bluemix does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

CVE-2020-3118 (AKA: CDPwn)

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisc...

PT-2020-19897 · Openwrt +1 · Openwrt +2

Name of the Vulnerable Software and Affected Versions: OpenWrt versions 18.06.0 through 18.06.6 OpenWrt version 19.07.0 LEDE versions 17.01.0 through 17.01.7 Description: A bug in the fork of the opkg package manager prevents correct parsing of embedded checksums in the signed repository index,...

CVE-2019-19891

CVE-2019-19891 concerns an encryption key vulnerability in Mitel SIP-DECT wireless devices (firmware versions 8.0 and 8.1) that could allow an attacker to perform a man-in-the-middle (MITM) attack and potentially intercept sensitive information. The CVE is referenced across multiple sources (NVD,...

PT-2020-10285

Name of the Vulnerable Software and Affected Versions Mitel SIP-DECT wireless devices versions 8.0 through 8.1 Description The issue allows an attacker to launch a man-in-the-middle attack, potentially enabling the interception of sensitive information. Recommendations For versions 8.0 and 8.1, a...