5877 matches found
CVE-2020-24587
The 802.11 standard that underpins Wi-Fi Protected Access WPA, WPA2, and WPA3 and Wired Equivalent Privacy WEP doesn’t require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and...
CVE-2021-27574: Cleartext Transmission of Sensitive Information
An issue was discovered in Emote Remote Mouse through 4.0.0.0. It uses cleartext HTTP to check, and request, updates. Thus, attackers can machine-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings...
EulerOS 2.0 SP3 : curl (EulerOS-SA-2021-1774)
According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification CURLOPTSSLVERIFYPEER, also disables the...
Ruby: imap: StartTLS stripping attack (CVE-2016-0772).
net/imap does not seem to raise an exception when the remote end imap server fails to respond with taggedresponse NO/BAD or OK to an explicit call of imap.starttls. This may allow a malicious MITM to perform a starttls stripping attack if the client code does not explicitly set usessl = true on...
Man-in-the-middle (MitM)
apache-maven is vulnerable to Man-in-the-middle MitM. The vulnerability exists because it allows downloading code from external repositories via HTTP by default, resulting in a potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to preten...
Man-in-the-middle (MitM)
github.com/hashicorp/vault is vulnerable to man-in-the-middle attack. The vulnerability exists due to missing hostnames validation when TLS is used to connect to Cassandra clusters...
Man-in-the-Middle (MitM)
nim is vulnerable to man-in-the-middle attack. nimble refresh fetches a list of Nimble packages over HTTPS by default. However, in case of an error, a non-TLS URL http://irclogs.nim-lang.org/packages.json is used and allows an attacker to perform MitM and deliver a modified package list containin...
FreeBSD : Apache Maven -- multiple vulnerabilities (20006b5f-a0bc-11eb-8ae6-fc4dd43e2b6a)
The Apache Maven project reports : We received a report from Jonathan Leitschuh about a vulnerability of custom repositories in dependency POMs. We've split this up into three separate issues : - Possible Man-In-The-Middle-Attack due to custom repositories using HTTP. More and more repositories u...
Fedora 33 : curl (2021-cab5c9befb)
The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-cab5c9befb advisory. - curl 7.1.1 to and including 7.75.0 is vulnerable to an Exposure of Private Personal Information to an Unauthorized Actor by leaking credentials in...
SUSE: Security Advisory (SUSE-SU-2020:3149-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2017:3234-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2016:1024-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2016:2653-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
GO-2021-0083 Improper certificate validation in github.com/hybridgroup/gobot
TLS certificate verification is skipped when connecting to a MQTT server. This allows an attacker who can MITM the connection to read, or forge, messages passed between the client and server...
GO-2021-0081 Insufficiently Protected Credentials in github.com/containers/image
The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, allowing an attacker that is able to MITM the connection to steal credentials...
FreeBSD : curl -- TLS 1.3 session ticket proxy host mixup (d10fc771-958f-11eb-9c34-080027f515ea)
Daniel Stenberg reports : Enabled by default, libcurl supports the use of TLS 1.3 session tickets to resume previous TLS sessions to speed up subsequent TLS handshakes. When using a HTTPS proxy and TLS 1.3, libcurl can confuse session tickets arriving from the HTTPS proxy but work as if they...
mongodb-client-encryption vulnerable to Improper Certificate Validation
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...
GHSA-RJMF-P882-645M mongodb-client-encryption vulnerable to Improper Certificate Validation
A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and th...
Improper Certificate Validation
Overview Version 1.2.0 of mongodb-client-encryption does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service...
OpenSSL Vulnerabilities Mar 2021
Summary Symantec Network and Information Security NIS products using affected versions of OpenSSL may be susceptible to two vulnerabilities. A remote attacker may be able to cause denial of service through application crashes. An application may successfully validate an invalid X.509 certificate...