5856 matches found
Mobile App: Improper validation of certificates within the iOS application
The ownCloud iOS Library was vulnerable against a remotely exploitable certification problem until version 1.1.2. The vulnerable library version is used by the official ownCloud iOS client until version 3.4.4. Specifically it has been discovered that the used networking library AFNetworking is pe...
OpenSSL Alternative Chains Certificate Forgery MITM Proxy
This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'openssl' class Metasploit3 'OpenSSL Alternative Chains Certificate Forgery MITM Proxy', 'Description' = %q This module exploits a logic error ...
CVE-2015-1288
The Spellcheck API implementation in Google Chrome before 44.0.2403.89 does not use an HTTPS session for downloading a Hunspell dictionary, which allows man-in-the-middle attackers to deliver incorrect spelling suggestions or possibly have unspecified other impact via a crafted file, a related...
Critical: java-1.7.0-openjdk
Issue Overview: Multiple flaws were discovered in the 2D, CORBA, JMX, Libraries and RMI components in OpenJDK. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions. CVE-2015-4760, CVE-2015-2628, CVE-2015-4731, CVE-2015-2590, CVE-2015-4732, CVE-2015-473...
Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2673-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2673-1 advisory. Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a...
Ubuntu: Security Advisory (USN-2673-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-2673-1: Thunderbird vulnerabilities
Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove the forward-secrecy property...
JVN#22546110: LINE@ vulnerable to script injection
LINE@ provided by LINE Corporation is an application used to communicate with others. LINE@ is vulnerable to MITM man-in-the-middle attacks since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM man-in-the-middle attacker...
USN-2656-1: Firefox vulnerabilities
Karthikeyan Bhargavan discovered that NSS incorrectly handled state transitions for the TLS state machine. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to skip the ServerKeyExchange message and remove the forward-secrecy property...
OpenSSL Alternative Chains Certificate Forgery MITM Proxy
This module exploits a logic error in OpenSSL by impersonating the server and sending a specially-crafted chain of certificates, resulting in certain checks on untrusted certificates to be bypassed on the client, allowing it to use a valid leaf certificate as a CA certificate to sign a fake...
Updated owncloud-client package fixes security vulnerability
ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...
MGASA-2015-0256 Updated owncloud-client package fixes security vulnerability
ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...
MiTo Xiu Xiu, the gReader, the Foxit PDF reader in the column: 1 4, of Android apps vulnerable to MiTM attacks-vulnerability warning-the black bar safety net
! AppBugs company researchers through the analysis found that there are 1 4 Total Total Download amount up to 8 million times the popular APP in processing social account login when there is a security risk, vulnerable to MiTM hijacking（MITM attack is. Problem application list MeituPic MiTo Xiu...
LG Handsets' App Update Doesn't Verify SSL Cert, Could Lead to Hijacking
Many smartphones manufactured by LG contain a vulnerability that can allow an attacker to replace an APK file with a malicious file of his choice. The problem is the result of several conditions on LG phones. Like other manufacturers, LG includes custom apps on its handsets, which are not availab...
McAfee ePolicy Orchestrator Man-in-the-Middle Attack Vulnerability (Jun 2015)
McAfee ePolicy Orchestrator is prone to a man-in-the-middle MITM vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
PT-2016-3478
Name of the Vulnerable Software and Affected Versions Python versions prior to 2.7.9 Python versions 3.x prior to 3.3.3 Description The issue arises from improper handling of wildcards in hostnames by the ssl.match hostname function, potentially allowing man-in-the-middle attackers to spoof serve...
Samsung Flaw Lets Hacker Easily Take Control of Your Galaxy Mobile Remotely
More than 600 Million users of Samsung Galaxy smartphones, including the newly released Galaxy S6, are potentially vulnerable to a software bug that allows hackers to secretly monitor the phone's camera and microphone, read text messages and install malicious apps. The vulnerability is due to a...
AIX 7.1 TL 3 : nettcp (IV73316) (POODLE)
A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 2...
AIX 7.1 TL 2 : nettcp (IV73418) (POODLE)
A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 2...
This POODLE Bites: Exploiting The SSL 3.0 Fallback
Introduction SSL 3.0 RFC6101 is an obsolete and insecure protocol. While for most practical purposes it has been replaced by its successors TLS 1.0 RFC2246, TLS 1.1 RFC4346, and TLS 1.2 RFC5246, many TLS implementations remain backwardscompatible with SSL 3.0 to interoperate with legacy systems ...