Man-in-the-Middle (MitM)

github.com/nlopes/slack is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the usage of hardcoded non-HTTPS Slack API URL...

CVE-2017-12740

Siemens LOGO! Soft Comfort All versions before V8.2 lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle MitM attack...

Code injection

Siemens LOGO! Soft Comfort All versions before V8.2 lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle MitM attack...

CVE-2017-12740

Siemens LOGO! Soft Comfort All versions before V8.2 lacks integrity verification of software packages downloaded via an unprotected communication channel. This could allow a remote attacker to manipulate the software package while performing a Man-in-the-Middle MitM attack...

CVE-2017-13864

An issue was discovered in certain Apple products. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. The issue involves the "APNs Server" component. It allows man-in-the-middle attackers to track users by leveraging mishandling of client certificates...

GhostInTheNet - Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan

Ultimate Network Stealther that makes Linux a Ghost In The Net and protects from MITM/DOS/scan. Properties: Network Invisibility Network Anonymity Protects from MITM/DOS Transparent Cross-platform Minimalistic Dependencies: Linux 2.4.26+ - will work on any Linux-based OS, including Whonix and...

Man-in-the-Middle (MitM)

github.com/letsencrypt/boulder is vulnerable to man-in-the-middle MitM attacks. The application is configured to assign X509 certificates over http, allowing a malicious user to intercept and inject their own certificate...

Hyperfox - HTTP/HTTPs MITM proxy and traffic recorder with on-the-fly TLS cert generation

Hyperfox is a security tool for proxying and recording HTTP and HTTPs communications on a LAN. Hyperfox is capable of forging SSL certificates on the fly if you provide it with a root CA certificate and its corresponding key. If the target machine recognizes the root CA as trusted, then HTTPs...

CVE-2017-3194

Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

Design/Logic Flaw

Pandora iOS app prior to version 8.3.2 fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

CVE-2017-3190

CVE-2017-3190 affects Flash Seats Mobile App for Android (1.7.9 and earlier) and iOS (1.9.51 and earlier). Root cause is improper SSL certificate validation during HTTPS connections, enabling potential MITM attacks and exposure of sensitive data. Vendor fixes are available: Android 1.7.10 and iOS...

CVE-2017-3194

The CVE concerns Pandora’s iOS app prior to version 8.3.2, where SSL certificate validation was not performed correctly, enabling potential MITM attacks on HTTPS connections. Affected component: Pandora iOS app; root cause: improper SSL certificate validation. Impact: attacker on the same network...

CVE-2017-3190

Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

openSUSE Security Update : opensaml (openSUSE-2017-1350)

This update for opensaml fixes the following issues : Security issue fixed : - CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks bsc1068685. This update was imported from the SUSE:SLE-12-SP1:Update...

Man-in-the-Middle (MitM)

botkit is vulnerable to man-in-the-middle MitM attacks. The library does not implement an app secret proof parameter when connecting to the Facebook API, allowing a malicious user who has a stolen app token to send messages from the chat bot's behalf...

Man-in-the-Middle (MitM)

django-cors-headers is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as the CORS middleware in django-cors-headers does not verify the request's scheme...

Man-in-the-Middle (MitM)

python-openid is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists due to the usage of urllib2 which does not perform the verification of SSL Certificates. This defeats the purpose of SSL Certificates, allowing tampered connections to succeed and to happen unnoticed...

SUSE-SU-2017:3234-1 Security update for opensaml

This update for opensaml fixes the following issues: Security issue fixed: - CVE-2017-16853: Fix the DynamicMetadataProvider class to properly configure itself with the MetadataFilter plugins, to avoid possible MITM attacks bsc1068685...

Banking Apps Found Vulnerable to MITM Attacks

Leading US and UK-based banks have patched a flaw found in their Android and iOS mobile apps that allowed adversaries to conduct man-in-the-middle attacks to steal customer credentials and view and manipulate network traffic. According to researchers at the School of Computer Science at the...

CVE-2017-2739

The upgrade package of Huawei Vmall APP Earlier than HwVmall 1.5.3.0 versions is transferred through HTTP. A man in the middle MITM can tamper with the upgrade package of Huawei Vmall APP, and to implant the malicious applications...