CVE-2021-27768

The CVE-2021-27768 entry applies to HCL Verse for Android, where hostname verification and SSL certificate validation during server setup and login are broken. This enables a MITM attack via a proxy in transparent mode and an invalid hostname certificate, potentially exposing sensitive account in...

CVE-2021-27768: Channel Accessible by Non-Endpoint

Using the ability to perform a Man-in-the-Middle MITM attack, which indicates a lack of hostname verification, sensitive account information was able to be intercepted. In this specific scenario, the application's network traffic was intercepted using a proxy server set up in 'transparent' mode...

AlmaLinux 8 : gfbgraph (ALSA-2022:1801)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2022:1801 advisory. - In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users...

Moderate: Red Hat Security Advisory: Red Hat OpenShift Logging Security and Bug update Release 5.3.7

Openshift Logging Bug Fix Release 5.3.7 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

Moderate: Red Hat Security Advisory: Openshift Logging Security and Bug update Release (5.2.10)

Openshift Logging Bug Fix Release 5.2.10 Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

dovecot: plaintext commands injection

It was found that dovecot could still accept plaintext commands while the STARTTLS negotiation process is ongoing. This could allow an active person in the middle, with valid credentials on dovecot, to, for example, steal confidential data such as the client's emails and passwords...

[SECURITY] Fedora 36 Update: bettercap-2.28-9.fc36

The Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks...

curl: Cookie injection from non-secure context

Summary: Curl allows injecting cookies over insecure HTTP connection that will then be sent to the target site when connecting over HTTPS. As documented in lib/cookie.c https://github.com/curl/curl/blob/a04f0b961333e1a19848d073d8c7db9c20b2a371/lib/cookie.cL1039 this should not be possible: / A...

CVE-2021-32010

This CVE describes an Inadequate Encryption Strength issue in the TLS stack of Secomea SiteManager, LinkManager, and GateManager affecting versions prior to 9.7. The root cause is weaknesses in TLS encryption that could enable man-in-the-middle attacks over the network. Affected products expose n...

SUSE-SU-2022:1536-1 Security Beta update for SUSE Manager Salt Bundle

This update fixes the following issues: venv-salt-minion: - Fix the regression caused by the patch removing strict requirement for OpenSSL 1.1.1 leading to read/write issues with ssl module for SLE 15, SLE 12, CentOS 7, Debian 9 bsc1198556 - Fixes for Python 3.10 - Fix salt-ssh opts poisoning...

CVE-2022-26491

A flaw was found in Pidgin. This issue allows the performance of a man-in-the-middle attack MITM against a client via DNS spoofing if the XMPP connections are not using the Domain Name System Security Extensions DNSSEC...

Unpatched DNS Related Vulnerability Affects a Wide Range of IoT Devices

Cybersecurity researchers have disclosed an unpatched security vulnerability that could pose a serious risk to IoT products. The issue, which was originally reported in September 2021, affects the Domain Name System DNS implementation of two popular C libraries called uClibc and uClibc-ng that ar...

OpenSSL 加密问题漏洞

OpenSSL is an open source general-purpose cryptographic library from the Openssl team capable of implementing the Secure Sockets Layer SSLv2/v3 and Secure Transport Layer TLSv1 protocols. The product supports multiple encryption algorithms, including symmetric ciphers, hashing algorithms, secure...

CVE-2022-1434

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipie...

[SECURITY] Fedora 34 Update: bettercap-2.28-9.fc34

The Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks...

[SECURITY] Fedora 35 Update: bettercap-2.28-9.fc35

The Swiss Army knife for 802.11, BLE and Ethernet networks reconnaissance and MITM attacks...

Ubuntu 22.04 LTS : nginx vulnerability (USN-5371-2)

The remote Ubuntu 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5371-2 advisory. USN-5371-1 fixed several vulnerabilities in nginx. This update provides the fix for CVE-2021-3618 for Ubuntu 22.04 LTS. Tenable has extracted the preceding...

EulerOS 2.0 SP5 : grilo (EulerOS-SA-2022-1535)

According to the versions of the grilo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users...

EulerOS 2.0 SP8 : grilo (EulerOS-SA-2022-1567)

According to the versions of the grilo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users...

Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - OpenSSL (CVE-2021-3601)

Summary Security Vulnerabilities affect IBM Cloud Private - OpenSSL Vulnerability Details CVEID: CVE-2021-3601 DESCRIPTION: OpenSSL could allow a remote authenticated attacker to bypass security restrictions, caused by the acceptance of a certificate with explicitly set Basic Constraints to...