CVE-2018-1348

NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack...

CVE-2018-0518

LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9968

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

Palo Alto Networks PAN-OS Information Disclosure Vulnerability (CNVD-2018-02409)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. An information disclosure vulnerability exists in Palo Alto Networks PAN-OS version 6.1, 7.1, 8.0.6-h3 and prior versions. A remote attacker could exploit this vulnerability to...

CVE-2017-3190

Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle MITM attacks...

Multiple Unify Product Information Disclosure Vulnerabilities

The Unify OpenStage 60 and others are IP telephones from Unify USA. An information disclosure vulnerability exists in multiple Unify products that stems from the program's failure to use a unique X.509 certificate and SSH host key. A remote attacker could use this vulnerability to conduct a...

UBUNTU-CVE-2017-12150

It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce "SMB signing" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text...

The vulnerability in the Bluetooth stack profile of the Android operating system allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability in the Bluetooth stack of the Android operating system’s Personal Area Networking PAN service is related to incorrect security requirements. Exploiting this vulnerability allows a remote attacker to create a network interface and use it to execute a “man-in-the-middle” attack...

Siemens LOGO!8 BM Man-in-the-Middle Attack Vulnerability

LOGO!8 is the 8th generation of Siemens intelligent logic controllers, the Nano PLC in the Siemens PLC family, which simplifies programming configurations, has an integrated panel for more displays, and can be easily networked and efficiently interconnected via the integrated Ethernet interface...

Foreman Redirect Vulnerability

Foreman is a set of lifecycle management tools for use in physical and virtual servers. The tool provides features such as service provisioning, configuration management, and status reporting. A security vulnerability exists in Foreman, which is caused by the program failing to redirect HTTP...

hammer_cli SSL Certificate Authentication Security Bypass Vulnerability

Hammer is a general-purpose clamp-based CLI framework from Foreman. hammer-cli provides only the core functionality. A SSL certificate authentication security bypass vulnerability exists in hammercli, which stems from the program failing to properly validate SSL certificates. An attacker could us...

MODX Revolution Reflective Cross-Site Scripting Vulnerability

MODX Revolution is a PHP-based open source content management system CMS from the U.S. company MODX. The system supports online collaboration, search engine optimization SEO, add-ons and more. A security vulnerability exists in the update and package-installation functionality of MODX Revolution...

CVE-2017-6445

The auto-update feature of Open Embedded Linux Entertainment Center OpenELEC 6.0.3, 7.0.1, and 8.0.4 uses neither encrypted connections nor signed updates. A man-in-the-middle attacker could manipulate the update packages to gain root access remotely...

CVE-2016-8966

IBM BigFix Inventory v9 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Shotwell is vulnerable

Shotwell is a Linux-based photo management software for the GNOME desktop environment. A security vulnerability exists in Shotwell version 0.22.0. The program fails to validate TLS and SSL certificates. An attacker can exploit this vulnerability to conduct a man-in-the-middle attack...

Cisco IOS and IOS XE Software Application-Hosting Framework HTTP Header Injection Vulnerability

Cisco IOS and IOS XE Software are operating systems developed by Cisco in the United States for its network devices. An HTTP header injection vulnerability exists in the Application-Hosting Framework component in Cisco IOS version 15.61T1 and IOS XE Software. When the Iox feature setting is...

chromium-browser: origin confusion in proxy authentication

Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication, which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream...

OpenSSL: SSLv2 doesn't block disabled ciphers

A flaw was found in the way malicious SSLv2 clients could negotiate SSLv2 ciphers that were disabled on the server. This could result in weak SSLv2 ciphers being used for SSLv2 connections, making them vulnerable to man-in-the-middle attacks...

DEBIAN-CVE-2015-3197

ssl/s2srvr.c in OpenSSL 1.0.1 before 1.0.1r and 1.0.2 before 1.0.2f does not prevent use of disabled ciphers, which makes it easier for man-in-the-middle attackers to defeat cryptographic protection mechanisms by performing computations on SSLv2 traffic, related to the getclientmasterkey and...

NTP Timestamp Bypass Vulnerability

NTP is a network protocol that synchronizes the clocks of two computers by exchanging packets. A security vulnerability in NTP allows a local attacker to perform a man-in-the-middle attack by sending packets with zero timestamps, bypassing the source timestamp restriction...