CVE-2019-16252

Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests, including login credentials and location data...

CVE-2020-3929

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages...

Information disclosure

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages...

CVE-2020-3929 GeoVision Door Access Control Device - Shared cryptographic keys

GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack with the derived keys and plaintext recover of encrypted messages...

CVE-2020-12714

An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman parameter of insufficient size could allow...

Nintendo: [3DS][SSL] Improper certificate validation allows an attacker to perform MitM attacks

Affected Systems - Platform: New Nintendo 3DS - Region: ALL - System version: = 11.13 Description The SSL system module does not properly validate the x509 certificates when establishing an SSL/TLS connection. Actually, the SSL system module does not check the signatures when validating a...

CVE-2020-11957

The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number Pairing Random with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with...

Code injection

The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number Pairing Random with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with...

CVE-2020-11957

CVE-2020-11957 affects Cypress PSoC Creator BLE 4.2 component, where versions before 3.64 generate a 128-bit Pairing Random with insufficient entropy. This weak random value enables a nearby attacker to perform a MITM during BLE pairing for both LE Secure Connections and LE Legacy Pairing (authen...

CVE-2020-11957

The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number Pairing Random with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with...

PT-2020-12949

Name of the Vulnerable Software and Affected Versions Cypress PSoC Creator BLE 4.2 component versions prior to 3.64 Description The Bluetooth Low Energy implementation generates a random number with significantly less entropy than specified during BLE pairing, allowing an attacker in radio range ...

CVE-2020-11957: Insufficient Entropy

The Bluetooth Low Energy implementation in Cypress PSoC Creator BLE 4.2 component versions before 3.64 generates a random number Pairing Random with significantly less entropy than the specified 128 bits during BLE pairing. This is the case for both authenticated and unauthenticated pairing with...

OPENSUSE-SU-2020:0694-1 Security update for openconnect

This update for openconnect fixes the following issues: Security issue fixed: - CVE-2020-12105: Fixed the improper handling of negative return values from X509check function calls that might have allowed MITM attacks bsc1170452. This update was imported from the SUSE:SLE-15:Update update project...

Central Security Project: Repositories of datanucleus are fetched over insecure protocol (http insted of https)

Maven artifact groupId: org.datanucleus artifactId: datanucleus-maven-parent version: 4.0.0 Vulnerability the jar files inside repositories are fetched using insecure protocol http instead of https. This allows these artifacts to be potentially MITMed to maliciously compromise them and infect the...

CVE-2020-1758

A flaw was found in Keycloak, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle MITM attack. Mitigation Turn off all kinds of email notifications including password reset mails...

Man-in-the-Middle (MitM)

Java-Websocket is vulnerable to Man-in-the-Middle MitM. The SSL hostname validation is not enabled by default, allowing an attacker to perform a man-in-the-middle attack to intercept and modify network traffic...

ManageEngine Asset Explorer Windows Agent Remote Code Execution

XL-2020-003 - Asset Explorer Windows Agent - Remote Code Execution =============================================================================== Identifiers ------------------------------------------------- CVE-2020-8838 XL-20-003 CVSSv3 score ------------------------------------------------- 7...

PT-2020-12511

Name of the Vulnerable Software and Affected Versions Java-WebSocket versions 1.4.1 and earlier Description The issue is related to an improper validation of certificates with host mismatch, where the WebSocketClient does not perform SSL hostname validation. This means that SSL certificates of...

PT-2020-15401 · Jenkins · Jenkins Amazon Ec2 Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Amazon EC2 Plugin versions 1.50.1 and earlier Description: The issue allows for man-in-the-middle attacks due to the unconditional acceptance of self-signed certificates and the lack of hostname validation when connecting to Windows...

CVE-2020-8896

CVE-2020-8896 — Google Earth Pro buffer overflow in khcrypt (≤7.3.2) A buffer overflow in the khcrypt implementation of Google Earth Pro versions up to and including 7.3.2 enables an attacker to perform a Man-in-the-Middle (MitM) attack by crafting a key to read data past the end of the buffer ho...