Facebook Open_Redirector/Broken_Authentecation exploit

This exploit includes two vulnerabilities at Facebook: 1- An Open Redirector at the mobile domain m.facebook.com which is hard to detect due to its special mechanism and harder to get fixed fully because it requires an non simple change at the platform to get fully patched and it could be exploit...

PT-2013-2846

Name of the Vulnerable Software and Affected Versions MAAS versions prior to 13.10 Description The issue allows remote attackers to modify downloaded files via a man-in-the-middle MITM attack because the integrity of these files is not verified. Recommendations For versions prior to 13.10, update...

CVE-2013-1058: Undefined Security Weakness

maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle MITM attack...

MOXA EDR-G903 Series Multiple Vulnerabilities

OVERVIEW This advisory provides mitigation details for vulnerabilities that impact Moxa EDR-G903 Series Routers. Independent researcher Neil Smith identified a hard-coded user account vulnerability and an insufficient entropy vulnerability in Moxa’s EDR-G903 series routers. By impersonating the...

Default configuration

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

PYSEC-2013-26

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

CVE-2013-4436 concerns SaltStack’s salt-ssh default configuration (Salt 0.17.0) that does not validate the SSH host key, enabling MITM-style impact. Multiple connected sources (GHSA-F22J-37JJ-CXW9, OSV, NVD variant) corroborate the MITM risk but do not provide exploit details. A remediation menti...

PT-2013-5015

Name of the Vulnerable Software and Affected Versions Salt aka SaltStack version 0.17.0 Description The issue concerns the default configuration of salt-ssh in Salt, which does not validate the SSH host key of requests. This allows remote attackers to potentially conduct a man-in-the-middle MITM...

CVE-2013-4436: Improper Input Validation

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

CVE-2012-0825 affects Drupal 6.x up to 6.23 and 7.x up to 7.11, where Attribute Exchange (AX) information is not signed, enabling MITM modification of AX data. Related advisories confirm this CVE in multiple distributions (e.g., Debian DSA-2776-1; MiracleLinux AXSA-2012-98:01). Remediation in aff...

CVE-2012-0825

Removed by vendor...

PT-2013-1515

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.22 Drupal versions 7.x through 7.10 Description The issue allows remote attackers to modify potentially sensitive information without detection via a man-in-the-middle MITM attack, as it does not verify that...

CVE-2012-0825: Exposure of Sensitive Information to an Unauthorized Actor

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

Puppet Enterprise < 3.0.1 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise install on the remote host is a version prior to 3.0.1. As a result, it reportedly has multiple vulnerabilities: - An error exists related to the included Ruby SSL client that could allow man-in-the-middle attacks. CVE-2013-4073...