CVE-2016-10680

CVE-2016-10680 affects adamvr-geoip-lite, a lightweight native JavaScript GeoIP API. The underlying issue is that geoip resources are downloaded over HTTP, making them susceptible to MITM modification or reading. This can compromise the integrity and availability of geolocation data used by an ap...

CVE-2016-10568

CVE-2016-10568 affects geoip-lite-country (pre-1.1.4). The library downloads data resources over HTTP, creating vulnerability to man-in-the-middle attacks. Impact ranges from data modification/read to potential code execution depending on the data/resource behavior, per multiple sources. Mitigati...

CVE-2016-10567

CVE-2016-10567 affects product-monitor before 2.2.5. The vulnerability stems from downloading JavaScript resources over HTTP, enabling MITM attackers to swap the requested JS with attacker-controlled code, potentially leading to remote code execution when the user loads the resource. No exploit d...

CVE-2016-10681

The CVE-2016-10681 issue affects roslib-socketio. Affected code downloads binary resources over HTTP, enabling MITM interception and, in a network-positioned scenario, potential remote code execution by substituting the requested binary with a malicious one. Public advisories (GHSA-xq8r-r72r-pqwm...

CERT Tapioca for MITM Analysis

CERT Tapioca is a utility for testing mobile or any other application using MITM techniques. CERT Tapioca development was sponsored by the United States Army Armament Research, Development and Engineering Center ARDEC as well as the United States Department of Homeland Security DHS. Installation...

Pet Trackers Open to MITM Attacks, Interception

UPDATE Family pets are near and dear to us, so smart collars and other devices for animals that track their locations are becoming popular; a world without the need for lost-pet flyers is after all a wonderful thing. The problem, according to researchers, is that these devices can leak sensitive...

Man-in-the-Middle (MitM)

github.com/cloudfoundry/gorouter is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the lack of validation on the value of the X-Forwarded-Proto header, allowing the client to use a http connection and be prone to MitM attacks...

CVE-2018-0591

The KINEPASS App for Android Ver 3.1.1 and earlier, and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2018-1127

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user...

MITM RDP Connections: Seth

Seth is a tool written in Python and Bash to MitM RDP connections by attempting to downgrade the connection in order to extract clear text credentials. It was developed to raise awareness and educate about the importance of properly configured RDP connections in the context of pentests, workshops...

Man-in-the-Middle (MitM)

ansible is vulnerable to man-in-the-middle MitM attack. The attack exists because SSH host key management is not done properly by default, failing to cache and check SSH host keys...

CVE-2013-2233

Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys...

Man-in-the-Middle(MitM) Attack

Apache Cassandra is vulnerable to man-in-the-middle MitM attacks. The attacks are possible because it does not support the SSL server option to verify hostname during inter-node SSL communication...

Ed: Session Cookie Without Secure Flag

Hi Ed, The bug mentioned in the report 343095 is not yet correctly patched I believe. Previously, the Researcher reports that the cookiegitlabsession is not Secure Missing Secure Flag and u closed that report as Informative and said that "Expoitability of this issue is so low that it does not...

Ericsson-LG iPECS NMS A.1Ac Credential Disclosure

-- coding: utf-8 -- Exploit Title: Ericsson-LG iPECS NMS - Cleartext Cred. Dump Vendor Notification: 03-03-2018 - No response Initial CVE: 04-04-2018 Disclosure: 21-04-2018 Exploit Author: Berk Cem GAPksel Contact: twitter.com/berkcgoksel || bgoksel.com Vendor Homepage: http://www.ipecs.com/...

Ericsson-LG iPECS NMS A.1Ac - Cleartext Credential Disclosure Exploit

Exploit for php platform in category web applications -- coding: utf-8 -- Exploit Title: Ericsson-LG iPECS NMS - Cleartext Cred. Dump Vendor Notification: 03-03-2018 - No response Initial CVE: 04-04-2018 Disclosure: 21-04-2018 Exploit Author: Berk Cem Göksel Contact: twitter.com/berkcgoksel ||...

Juniper Junos Short MacSec Keys Configuration CKN / CAK Key Extension Brute-force Mitm Spoofing (JSA10854)

According to its self-reported version number, the remote Junos device is affected by man-in-the-middle spoofing vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid109215; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2017-12196

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the...

CVE-2017-12196

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the...

Authorization

undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the...