CVE-2021-22909: Channel Accessible by Non-Endpoint

A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle MitM attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later...

GHSA-4F68-49QQ-H392 Improper certificate validation in em-imap

em-imap 0.5 and earlier use the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

Improper Certificate Validation in EM-HTTP-Request

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

Improper certificate validation in em-imap

em-imap 0.5 and earlier use the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified...

PT-2021-15266 · Ubiquiti · Edgemax Edgerouter

Name of the Vulnerable Software and Affected Versions: EdgeMAX EdgeRouter versions prior to V2.0.9-hotfix.1 Description: A vulnerability found in EdgeMAX EdgeRouter could allow a malicious actor to execute a man-in-the-middle MitM attack during a firmware update. Recommendations: For EdgeMAX...

CVE-2021-29043

The CVE-2021-29043 issue affects Liferay Portal/DXP: Portal Store module versions 7.0.0–7.3.5 (and Liferay DXP 7.0 prior to fix pack 97, 7.1 prior to fix pack 21, 7.2 prior to fix pack 10, 7.3 prior to fix pack 1) do not obfuscate the S3 store proxy password. This enables an attacker to harvest t...

CVE-2021-22138

CVE-2021-22138 : Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 contain a TLS certificate validation flaw in the monitoring feature. When a trusted server CA certificate is specified, Logstash may fail to properly verify the monitoring server’s certificate, enabling a possible man-in-...

CVE-2021-3003

Affected software: Agenzia delle Entrate Desktop Telematico 1.0.0. The vulnerability stems from contacting the jws.agenziaentrate.it server over cleartext HTTP, enabling a man-in-the-middle to spoof product updates. Underlying cause: lack of TLS for update channel. Impact: potential spoofed updat...

Security Bulletin: Vulnerabilities in Apache Commons and Log4j affect IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments

Summary Vulnerabilities in Apache Commons and Log4j, such as execution of arbitrary code on the system, man-in-the-middle attack, and information disclosure, could affect the IBM Spectrum Protect Backup-Archive Client and IBM Spectrum Protect for Virtual Environments. UPDATED 1/29/2021: Added 7.1...

CVE-2021-27574

The CVE-2021-27574 issue affects Emote Remote Mouse up to version 4.0.0.0, where the update mechanism uses cleartext HTTP to check and fetch updates. This design enables a man-in-the-middle attacker to replace a legitimate update with a malicious binary without triggering SSL errors or warnings. ...

PT-2021-17516

Name of the Vulnerable Software and Affected Versions Emote Remote Mouse versions prior to 4.0.0.1 Description An issue was discovered where the software uses cleartext HTTP to check and request updates. This allows attackers to perform a man-in-the-middle attack, enabling them to download a...

[ASA-202104-6] nimble: multiple issues

Arch Linux Security Advisory ASA-202104-6 ========================================= Severity: High Date : 2021-04-29 CVE-ID : CVE-2021-21372 CVE-2021-21373 CVE-2021-21374 Package : nimble Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1842 Summary ======= The packag...

Unbound Configuration Injection Vulnerability

Unbound is a DNS resolver that supports validation, recursion, and caching features. A configuration injection vulnerability exists in createunboundadservers.sh in versions of Unbound prior to 1.9.5. A man-in-the-middle attacker can exploit this vulnerability to inject configuration via a plainte...

CVE-2019-25031

Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contributed script from the...

CVE-2019-25031

Unbound before 1.9.5 allows configuration injection in createunboundadservers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. createunboundadservers.sh is a contributed script from the...

CVE-2021-3494

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if...

Design/Logic Flaw

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if...

GHSA-7359-3C6R-HFC2 Improper Certificate Validation in oauth ruby gem

lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information...

Fibaro Home Center MITM / Missing Authentication / Code Execution Vulnerabilities

Fibaro Home Center Light and Fibaro Home Center 2 versions 4.600 and below suffer from man-in-the-middle, missing authentication, remote command execution, and missing encryption vulnerabilities. Fibaro Home Center MITM / Missing Authentication / Code Execution Vendor description:...

GO-2020-0013 Man-in-the-middle attack in golang.org/x/crypto/ssh

By default host key verification is disabled which allows for man-in-the-middle attacks against SSH clients if ClientConfig.HostKeyCallback is not set...