5866 matches found
CVE-2021-44718
wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...
CVE-2021-44718
CVE-2021-44718 affects wolfSSL up to version 5.0.0, where the client component can be overwhelmed by crafted MITM traffic because the client accepts TLS messages normally destined for servers, causing denial of service and an infinite loop. The issue is a client-side handling flaw in TLS message ...
CVE-2021-44718
wolfSSL through 5.0.0 allows an attacker to cause a denial of service and infinite loop in the client component by sending crafted traffic from a Machine-in-the-Middle MITM position. The root cause is that the client module accepts TLS messages that normally are only sent to TLS servers...
GHSA-RF3F-3P37-2QH4 python-scciclient vulnerable to Man-in-the-middle (MITM) attacks
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle MITM attacks...
CVE-2022-36076: Cross-Site Request Forgery (CSRF)
NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added and later checked a nonce was inadvertently rendered opt-i...
CVE-2022-2996
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle MITM attacks...
CVE-2022-2996
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle MITM attacks...
CVE-2022-2996: Improper Certificate Validation
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle MITM attacks...
CVE-2022-2996
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle MITM attacks...
CVE-2022-2996
A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified. This issue opens up the connection to possible Man-in-the-middle MITM attacks...
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gfbgraph (SUSE-SU-2022:2876-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2876-1 advisory. - CVE-2021-39358: Fixed missing TLS certificate verification bsc1189850. Tenable has extracted the...
OpenWRT < 18.06.7, 19.x < 19.07.1 Multiple Vulnerabilities
OpenWRT is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
RTLS Systems Found Vulnerable to MiTM Attacks and Location Tampering
Researchers have disclosed multiple vulnerabilities impacting Ultra-wideband UWB Real-time Locating Systems RTLS, enabling threat actors to launch adversary-in-the-middle AitM attacks and tamper with location data. "The zero-days found specifically pose a security risk for workers in industrial...
CVE-2022-34624
CVE-2022-34624 affects Mealie 1.0.0beta3, where download tokens are not terminated after logout, enabling a man-in-the-middle via a crafted GET request. The NVD entry lists a CVSS 3.1 base score of 5.9 (MEDIUM) with NETWORK attack vector and HIGH confidentiality impact, and NO exploitation detail...
Fixed CVE-2022-29154 in rsync
CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server MITM attack - Add '%check unset DISPLAY ' section but disable broken 'daemon' and 'hardlinks' tests...
CLSA-2022-1660759162 Fixed CVE-2022-29154 in rsync
CVE-2022-29154: fix arbitrary file write vulnerability via malicious rysnc server MITM attack - Add '%check unset DISPLAY ' section but disable broken 'daemon' and 'hardlinks' tests...
Internet Bug Bounty: Pause-based desync in Apache HTTPD
Apache was vulnerable to a pause-based desync. This vulnerability is described in detail in my whitepaper here: https://portswigger.net/research/browser-powered-desync-attackspause Impact This enables server-side HTTP Request Smuggling when Apache is deployed as a back-end server, and it also...
CVE-2022-32293: Use After Free
In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes or code execution...
Fedora: Security Advisory for bettercap (FEDORA-2022-5ef0bd9a27)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
