CVE-2018-5471

A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A cleartext transmission of sensitive information vulnerability in the web interface has been identified, which may all...

CVE-2018-5461

The CVE-2018-5461 issue affects Belden Hirschmann Classic Platform Switches (RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, OCTOPUS). The vulnerability is due to Inadequate Encryption Strength in the web interface, enabling information disclosure through a successful man-in-the-middle attack. Con...

Arista Networks EOS 4.17 Multiple Vulnerabilities (SA0024) (SWEET32)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library : - An information disclosure vulnerability exists in the dsasignsetup function in dsaossl.c due to a failure to properly ensure the use of constant-time...

Semrush: SSLv3 Poodle Attack on Ip Of semrush

Summary: POODLE SSLv3 bug on multiple servers Description: CVE-2014-3566: The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka...

CVE-2017-17455

Summary of CVE-2017-17455 : Mahara versions 16.10 before 16.10.7, 17.04 before 17.04.5, and 17.10 before 17.10.2 are vulnerable to a MITM-induced redirect that forces users to interact with Mahara over HTTP rather than HTTPS, even when an SSL certificate is present. The description states the imp...

CVE-2017-10963

CVE-2017-10963 – Samsung Knox : In Knox SDS IAM and EMM 16.11 on Samsung devices, a man‑in‑the‑middle attacker can inspect traffic from a Samsung server and inject content during the update sequence, allowing installation of arbitrary apps into the Knox container without user knowledge. These app...

JVN#75453852: LINE for iOS fails to verify SSL server certificates

LINE for iOS provided by LINE Corporation fails to verify SSL server certificates due to the vulnerability existed in the Third Party SDK which is incorporated in the application. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. According to the...

Schneider Electric IGSS Mobile

CVSS v3 6.4 ATTENTION: Locally exploitable/low skill level to exploit. Vendor: Schneider Electric Equipment: IGSS Mobile Vulnerabilities: Improper Certificate Validation, Plaintext Storage of a Password AFFECTED PRODUCTS Schneider Electric reports that the vulnerabilities affect the following IGS...

Security feature bypass

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

CVE-2017-9968

A security misconfiguration vulnerability exists in Schneider Electric's IGSS Mobile application versions 3.01 and prior in which a lack of certificate pinning during the TLS/SSL connection establishing process can result in a man-in-the-middle attack...

CVE-2017-9968

IGSS Mobile (Schneider Electric) affected: Android and iOS apps version 3.01 and earlier. Root cause: missing certificate pinning during TLS/SSL handshake, enabling potential MITM risks. Public-facing impact: credential exposure risk and MITM possibility as described in ICSA-18-046-03; CVSS v3 ba...

CVE-2018-6826

VULNERABILITY: VOBOT CLOCK devices before version 0.99.30 are affected by a remote code execution issue. The root cause is use of plaintext HTTP to download a breakout program, enabling a man-in-the-middle to observe a local user launching the Breakout Easter Egg feature and then send a crafted H...

All Ledger hardware wallets vulnerable to man in the middle attack

By Waqas Ledger hardware wallet that is currently operating in the cryptocurrency This is a post from HackRead.com Read the original post: All Ledger hardware wallets vulnerable to man in the middle attack...

Elastic Logstash 'CVE-2015-5619' Man in the Middle Security Bypass Vulnerability

Elastic Logstash is prone to a security bypass vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elastic:logstash";...

Elastic Logstash 'CVE-2015-5378' Man in the Middle Security Bypass Vulnerability - Linux

Elastic Logstash is prone to a security bypass vulnerability. This VT has been deprecated and merged into the VT VT SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2018-1000002

Improper input validation bugs in DNSSEC validators components in Knot Resolver prior version 1.5.2 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay...

CVE-2014-3607

DefaultHostnameVerifier in Ldaptive formerly vt-ldap does not properly verify that the server hostname matches a domain name in the subject's Common Name CN field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

Remote code execution

The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack...

CVE-2017-16905: Improper Control of Generation of Code

The DuoLingo TinyCards application before 1.0 for Android has one use of unencrypted HTTP, which allows remote attackers to spoof content, and consequently achieve remote code execution, via a man-in-the-middle attack...

Updated samba packages fix security vulnerabilities

Updated samba packages fix security vulnerabilities: Stefan Metzmacher discovered that Samba incorrectly enforced SMB signing in certain situations. A remote attacker could use this issue to perform a man in the middle attack. CVE-2017-12150 Stefan Metzmacher discovered that Samba incorrectly...