Apple announces 3 new security features

Apple has announced three new security features focused on protecting user data in the cloud: iMessage Contact Key Verification, Security Keys for Apple ID, and Advanced Data Protection for iCloud. iMessage Contact Key Verification and Security Keys for Apple ID will be available globally in 2023...

Apple Boosts Security With New iMessage, Apple ID, and iCloud Protections

Apple on Wednesday announced a raft of security measures, including an Advanced Data Protection setting that enables end-to-end encrypted E2EE data backups in its iCloud service. The headlining feature, when turned on, is expected to secure 23 data categories using E2EE, including device and...

jenkins-plugin: Man-in-the-Middle (MitM) in org.jenkins-ci.plugins:git-client

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

CVE-2022-36881

A flaw was found in the Git-Client Jenkins plugin. The affected versions of the Jenkins Git client Plugin do not perform SSH host key verification when connecting to Git repositories via SSH, enabling Man-in-the-middle attacks...

GHSA-CM7J-P8HC-97VJ Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meet...

CVE-2022-36881

Jenkins Git client Plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks...

Missing hostname verification in git-client

git-client 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH. This lack of verification could be abused using a man-in-the-middle attack to intercept these connections. git-client 3.11.1 provides strategies for performing host key verificati...

PT-2022-5835 · Jenkins · Jenkins Git Client Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Git client Plugin versions 3.11.0 and earlier Description: The issue is related to the lack of SSH host key verification when connecting to Git repositories via SSH, which enables man-in-the-middle attacks. This is due to shortcomings...

github-action-merge-dependabot 数据伪造问题漏洞

github-action-merge-dependabot is used to automatically approve and merge dependabot PRs. A security vulnerability exists in github-action-merge-dependabot versions prior to 3.2.0, which stems from the fact that it does not check whether commits created by dependabot are verified with the correct...

PT-2022-19473

Name of the Vulnerable Software and Affected Versions github-action-merge-dependabot versions prior to 3.2.0 Description github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests PRs. Prior to version 3.2.0, it does not check if a commit created b...

GHSA-X654-4WJH-74Q6 Jenkins SSH Build Agents Plugin did not verify host keys

It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle attacks...

GHSA-322X-JV5H-CVJH Jenkins Ansible Plugin man in the middle vulnerability

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in AbstractAnsibleInvocation.java, AnsibleAdHocCommandBuilder.java, AnsibleAdHocCommandInvocationTest.java, AnsibleContext.java, AnsibleJobDslExtension.java, AnsiblePlaybookBuilder.java, AnsiblePlaybookStep.java that...

CVE-2021-36992

There is a Public key verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2021-36992

There is a Public key verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2021-36992

There is a Public key verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2021-36992: Undefined Security Weakness

There is a Public key verification vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may affect service confidentiality...

PT-2021-21428

Name of the Vulnerable Software and Affected Versions Huawei Smartphone affected versions not specified Description The issue is related to a Public key verification vulnerability. Successful exploitation of this vulnerability may affect service confidentiality. Recommendations At the moment, the...

End-to-end encryption device setup did not verify public key

None...

CVE-2021-32727

Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private...

CVE-2021-32727

Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private...