4416 matches found
MySQL 5.6.x < 5.6.36 Multiple Vulnerabilities (April 2017 CPU) (July 2017 CPU) (Riddle)
The version of MySQL running on the remote host is 5.6.x prior to 5.6.36. It is, therefore, affected by multiple vulnerabilities : - A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but...
Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution
Microsoft Windows - ManagementObject Arbitrary .NET Serialization Remote Code Execution Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1081 Windows: ManagementObject Arbitrary .NET Serialization RCE Platform: .NET 4.6, Powershell 4. Tested between Server 2016 and Windows 10...
Evilginx - MITM Attack Framework [Advanced Phishing With Two-factor Authentication Bypass]
Evilginx is a man-in-the-middle attack framework used for phishing credentials and session cookies of any web service. It's core runs on Nginx HTTP server, which utilizes proxypass and subfilter to proxy and modify HTTP content, while intercepting traffic between client and server. You can learn...
Foscam Cameras And Network Devices Hardcoded Keys
Two issues in one that nullify SSL in foscam devices: All Foscam networked cameras use the same SSL private key that is hard coded into the downloadable firmware. This is easily extracted using a utility like binwalk and would allow an attacker to MITM any Foscam device. One devices SSL keys are...
Unverified SSL Certificates
hammercli uses unverified SSL certificates by default. When hammercli initiates HTTPS connections using apipie-binding and rest-clients, it doesn't verify that the SSL certificate is correct. This allows man-in-the-middle MitM attacks...
Man-in-the-Middle (MitM)
ansible is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists because it does not perform ample validation of HTTPS certificate using geturl and uri modules. Therefore, it fails to catch the mismatch between server hostname and a domain name in the subject's Common Name CN or...
Hardcoded credentials
Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...
CVE-2016-8273
Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...
CVE-2016-8273
Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...
CVE-2016-8273
Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...
CVE-2016-8273
Huawei HiSuite PC client (version 4.0.5.300_OVE) is vulnerable due to using insecure HTTP to download upgrade packages and not validating package integrity. This allows a local attacker to conduct a man‑in‑the‑middle attack to interrupt or replace the downloaded software, potentially compromising...
RubyGems: Request Hijacking Vulnerability in RubyGems 2.6.11 and earlier
Description: The RubyGems client supports a gem server API discovery functionality, which is used when pushing or pulling gems to a gem distribution/hosting server, like RubyGems.org. This functionality is provided via a SRV DNS request to the users gem source hostname prepended with...
CVE-2017-2448
An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. The issue involves the "Keychain" component. It allows man-in-the-middle attackers to bypass an iCloud Keychain secret protection mechanism by leveraging...
Pandora iOS app does not properly validate SSL certificates
Overview The Pandora iOS app fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks. Description CWE-295: Improper Certificate Validation - CVE-2017-3194 Pandora is a streaming music service. On iOS devices...
CVE-2017-5239
Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...
Information disclosure
Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...
CVE-2017-5239
CVE-2017-5239 concerns the Eview EV-07S GPS Tracker, where information disclosure occurs due to a lack of standard encryption when transmitting sensitive data (e.g., GPS data, IMEI) to a centralized monitoring service. The vulnerability implies potential MITM exposure of PII over the network. The...
CVE-2017-5239
Due to a lack of standard encryption when transmitting sensitive information over the internet to a centralized monitoring service, the Eview EV-07S GPS Tracker discloses personally identifying information, such as GPS data and IMEI numbers, to any man-in-the-middle MitM listener...
New Relic: SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability
Hi, I get in touch to report that cloud.newrelic.com is vulnerable to CVE-2014-3566 POODLE. Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network...