4422 matches found
CVE-2021-20328 MongoDB Java driver client-side field level encryption not verifying KMS host name
Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...
CVE-2021-20328
CVE-2021-20328 affects specific versions of the MongoDB Java driver that support Field Level Encryption (CSFLE). The root cause is improper host name verification on the KMS server’s certificate, enabling a privileged MITM attacker to intercept traffic between the Java driver and the KMS service ...
CVE-2021-20327
CVE-2021-20327 affects the Node.js mongodb-client-encryption library, specifically version 1.2.0, which does not perform proper validation of the KMS server certificate. This can enable an attacker with privileged network access to perform a MITM and intercept traffic between the Node.js driver a...
CVE-2021-20327 MongoDB Node.js client side field level encryption library may not be validating KMS certificate
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...
MongoDB Node.js client side field level encryption library may not be validating KMS certificate
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...
MongoDB Java driver client-side field level encryption not verifying KMS host name
Specific versions of the Java driver that support client-side field level encryption CSFLE fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffi...
CVE-2020-24393
CVE-2020-24393 affects TweetStream 2.6.1. The vulnerability arises from insecure use of the eventmachine library that omits TLS hostname validation, enabling potential man-in-the-middle attacks. Public sources (including Red Hat, OSV, MV sources) reiterate the same description and do not specify ...
CVE-2021-20410
IBM Security Verify Information Queue (ISIQ) versions 1.0.6 and 1.0.7 expose InfluxDB credentials via a logs stack YAML configuration, allowing an authenticated user to read credentials over the network through MITM. The issue is documented under CVE-2021-20410, with remediation advising customer...
CVE-2021-20409
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...
Code injection
Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...
CVE-2020-5812
CVE-2020-5812 affects Nessus AMI versions 8.12.0 and earlier. The issue is with certificate validation (noted as not validating or incorrectly validating a certificate), which could allow an attacker to perform a man-in-the-middle (MITM) attack by spoofing a trusted entity. The connected document...
CVE-2020-5812
Nessus AMI versions 8.12.0 and earlier were found to either not validate, or incorrectly validate, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack...
CentOS 8 : container-tools:rhel8 (CESA-2020:4694)
The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4694 advisory. - containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters CVE-2020-10749 - QEMU: slirp: networking out-of-bound...
DEBIAN-CVE-2021-3336
DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior sending an ED22519, ED448, ECC, or RSA signature without the corresponding certificate. The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3...
Enhancing Email Security with MTA-STS and SMTP TLS Reporting
In 1982, when SMTP was first specified, it did not contain any mechanism for providing security at the transport level to secure communications between mail transfer agents. Later, in 1999, the STARTTLS command was added to SMTP that in turn supported the encryption of emails in between the...
Man-in-the-Middle (MitM)
erlang is vulnerable to man-in-the-middle attack. The SSL application accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority, potentially allowing for man-in-the-middle attacks...
NSA Suggests Enterprises Use 'Designated' DNS-over-HTTPS' Resolvers
The U.S. National Security Agency NSA on Friday said DNS over HTTPS DoH — if configured appropriately in enterprise environments — can help prevent "numerous" initial access, command-and-control, and exfiltration techniques used by threat actors. "DNS over Hypertext Transfer Protocol over Transpo...
Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities
Summary IBM Security Guardium Insights has addressed the following vulnerabilities Vulnerability Details CVEID: CVE-2020-8244 DESCRIPTION: Node.js bl module could allow a remote attacker to obtain sensitive information, caused by a buffer over-read flaw in the consume function. By sending a...
PT-2021-2204 · Siemens · C-Plug +2
Name of the Vulnerable Software and Affected Versions: SCALANCE X-200 switch family incl. SIPLUS NET variants versions prior to V5.2.5 SCALANCE X-200IRT switch family incl. SIPLUS NET variants versions prior to V5.5.0 SCALANCE X-200RNA switch family versions prior to V3.2.7 Description: A...
