6036 matches found
CVE-2024-34328
The access control system Sielox AnyWare v2.1.2 is vulnerable to an open redirect caused by improper validation of the Host header when generating absolute URLs during redirection. An attacker can craft a URL with a modified Host header to redirect users to a malicious domain, potentially enablin...
Apache 2.4.x < 2.4.64 Multiple Vulnerabilities
According to its banner, the version of Apache running on the remote host is 2.4.x prior to 2.4.64. It is, therefore, affected by multiple vulnerabilities: - HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of...
BIT-APACHE-2025-49812 Apache HTTP Server: mod_ssl TLS upgrade attack
In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommend...
CVE-2025-30024
The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack...
CVE-2025-30024
The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack...
CVE-2025-30024
Axis Communications Axis.Remoting protocol flaws in the client–server communication could enable a man-in-the-middle attack on Axis Device Manager and related Camera Station products. The CVE-2025-30024 entry specifically notes a MITM bypass of authentication/flow integrity, with an impact score ...
CVE-2025-30024
The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack...
CVE-2025-30024
The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack...
PT-2025-29201
Name of the Vulnerable Software and Affected Versions Apache HTTP Server affected versions not specified Description The communication protocol used between the client and server has a flaw that could be leveraged to execute a man-in-the-middle attack. Recommendations At the moment, there is no...
PT-2025-29228 · Red Hat · Ansible
Name of the Vulnerable Software and Affected Versions: Ansible affected versions not specified Description: A flaw exists in Ansible where sensitive cookies without security flags transmitted over non-encrypted channels can lead to Man-in-the-Middle MitM and Cross-site scripting XSS attacks...
CBL Mariner 2.0 Security Update: erlang (CVE-2025-46712)
The version of erlang installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-46712 advisory. - Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for...
CVE-2025-30024: Improper Certificate Validation
The communication protocol used between client and server had a flaw that could be leveraged to execute a man in the middle attack...
Azure Linux 3.0 Security Update: erlang (CVE-2025-46712)
The version of erlang installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-46712 advisory. - Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for...
CVE-2025-49812
In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommend...
CVE-2025-49812 Apache HTTP Server: mod_ssl TLS upgrade attack
In some modssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade. Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommend...
CVE-2025-49812
Apache HTTP Server versions through 2.4.63 are vulnerable to an HTTP desynchronisation attack via mod_ssl . Specifically, a man-in-the-middle attacker can hijack an HTTP session using a TLS upgrade . This issue only affects configurations where "SSLEngine optional" is used to enable TLS upgrades....
Third-Party Dependency in Bamboo Data Center and Server
This High severity Third-Party Dependency vulnerability was introduced in versions 10.2.2 and 11.0.0 of Bamboo Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N allows an unauthenticated...
PT-2025-28373 · Siemens · Sicam Toolbox Ii
Name of the Vulnerable Software and Affected Versions: SICAM TOOLBOX II versions prior to V07.11 Description: A issue has been identified in the application where it fails to compare the common name of a device's certificate with an expected value when establishing an HTTPS connection to the TLS...
PT-2025-28372 · Siemens · Sicam Toolbox Ii
Name of the Vulnerable Software and Affected Versions: SICAM TOOLBOX II versions prior to V07.11 Description: A issue has been identified in the application where it fails to check the extended key usage attribute of a device's certificate when establishing an HTTPS connection to the TLS server o...