CVE-2024-35061: Missing Encryption of Sensitive Data

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, fully remote code execution...

CVE-2024-35061

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, fully remote code execution...

RHEL 6 : mozilla (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - Mozilla: Stack overflow due to incorrect parsing of SMTP server response codes CVE-2020-26970 - Mozilla:...

F5 BIG-IP Next Central Manager Man-in-the-Middle Attack Vulnerability

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A man-in-the-middle attack vulnerability exists in F5 BIG-IP Next Central Manager, which can be exploited by an attacker to ga...

F5 BIG-IP Next Central Manager Man-in-the-Middle Attack Vulnerability (CNVD-2024-22213)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A man-in-the-middle attack vulnerability exists in F5 BIG-IP Next Central Manager, which can be exploited by an attacker to...

Improper Certificate Validation

transifex-client is vulnerable to Improper Certificate Validation. The vulnerability is due to not validating X.509 certificates during data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate...

Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management

Summary Multiple vulnerabilities were addressed in IBM Application Performance Management 8.1.4.0 IF15 patch Vulnerability Details CVEID:CVE-2020-13920 DESCRIPTION: Apache ActiveMQ is vulnerable to a man-in-the-middle attack, caused by improper authentication validation when connecting to the JMX...

CVE-2019-19752

nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build...

CVE-2024-29950 Brocade SANnav before v2.3.1, v2.3.0a uses weak encryption

The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could allow a remote, unauthenticated attacker to perform a man-in-the-middle attack...

CVE-2024-29950 Brocade SANnav before v2.3.1, v2.3.0a uses weak encryption

The class FileTransfer implemented in Brocade SANnav before v2.3.1, v2.3.0a, uses the ssh-rsa signature scheme, which has a SHA-1 hash. The vulnerability could allow a remote, unauthenticated attacker to perform a man-in-the-middle attack...

CVE-2024-29950

CVE-2024-29950 affects Brocade SANnav prior to 2.3.1 and 2.3.0a. The FileTransfer class uses the ssh-rsa signature scheme with SHA-1, enabling a remote, unauthenticated attacker to potentially perform a man-in-the-middle attack. Public disclosures from NVD, Red Hat, and Broadcom/Brocade advisorie...

PT-2024-27910 · Unknown · Quick Share

Name of the Vulnerable Software and Affected Versions: Quick Share versions prior to 1.0.1724.0 Description: There exists an issue in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a...

nginxWebUI Trust Management Issue Vulnerability

nginxWebUI is an nginx web configuration tool. A trust management issue vulnerability exists in nginxWebUI, which stems from improper certificate validation of the nginxPath parameter of the handlePath method of the /adminPage/conf/saveCmd file. An attacker could exploit this vulnerability to cau...

IBM Security verify Access Appliance Trust Management Issue Vulnerability

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as the Web, mobile, IoT and cloud using risk-based access, single sign-on, integrated access management controls...

Palo Alto Networks PAN-OS Trust Management Issues Vulnerability

Palo Alto Networks PAN-OS is a next-generation firewall software from Palo Alto Networks, USA. Palo Alto Networks PAN-OS is vulnerable to a trust management issue that arises from the use of weak low bit strength device certificates. An attacker could exploit this vulnerability to perform a...

Security Bulletin: Multiple Security Vulnerabilities were found in Open Source libraries used to deploy IBM Security Verify Access Appliances (CVE-2024-31871, CVE-2024-31872, CVE-2024-31873, CVE-2024-31874)

Summary An Open Source repository of python deployment scripts for ISVA Appliance is published on GitHub at https://github.com/IBM-Security/ibmsecurity. Vulnerabilities reported in the public repository have been addressed. Vulnerability Details CVEID:CVE-2024-31872 DESCRIPTION: IBM Security Veri...

CVE-2024-31872

CVE-2024-31872 concerns IBM Security Verify Access Appliance (affected: 10.0.0–10.0.7). The root cause, per the sources, is missing certificate validation during deployment of Open Source scripts, enabling a malicious actor to conduct a man-in-the-middle attack. Impact is described as compromisin...

PT-2024-24259

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access Appliance versions 10.0.0 through 10.0.7 Description The issue allows a malicious actor to conduct a man-in-the-middle attack when deploying Python scripts due to improper certificate validation. Recommendations For...

CVE-2024-29445

This CVE entry is rejected and not used; it does not represent an active vulnerability entry.

CVE-2024-31872: Improper Certificate Validation

IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scripts due to missing certificate validation. IBM X-Force ID: 287316...