CVE-2015-0210: Improper Certificate Validation

wpasupplicant 2.0-16 does not properly check certificate subject name, which allows remote attackers to cause a man-in-the-middle attack...

CVE-2015-3206

The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...

CVE-2015-3206

The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...

CVE-2015-3206

CVE-2015-3206 affects the pykerberos library (checkPassword) where the KDC is not authenticated, enabling potential MITM or DoS via spoofed KDC responses. Connected sources indicate mitigations include enabling KDC verification (e.g., via a krb5.keytab and related verify option) and applying patc...

CVE-2017-11506

Affected software and scenario: Nessus Agent and Nessus Scanner prior to version 6.11 (6.x) when linking to Tenable.io or other manager. Root cause: during the initial outgoing connection, the manager’s TLS certificate is not verified, creating a potential MITM condition. Impact: could allow an a...

CVE-2017-9857

The vulnerability CVE-2017-9857 in SMA Solar Technology products stems from the SMAdata2+ protocol: it does not properly use authentication with encryption, making it vulnerable to man-in-the-middle, packet injection, and replay attacks. Affected are Sunny Boy TLST-21/TL-21 and Sunny Tripower TL-...

CVE-2017-9857

An issue was discovered in SMA Solar Technology products. The SMAdata2+ communication protocol does not properly use authentication with encryption: it is vulnerable to man in the middle, packet injection, and replay attacks. Any setting change, authentication packet, scouting packet, etc. can be...

RedHat Update for python RHSA-2017:1868-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2017-0243 Updated freerdp packages fix security vulnerabilities

An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle...

CVE-2015-0839

The hp-plugin utility in HP Linux Imaging and Printing HPLIP makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads...

Code injection

The TLS and DTLS processing functionality in Citrix NetScaler Application Delivery Controller ADC and NetScaler Gateway devices with firmware 9.x before 9.3 Build 68.5, 10.0 through Build 78.6, 10.1 before Build 130.13, 10.1.e before Build 130.1302.e, 10.5 before Build 55.8, and 10.5.e before Bui...

CVE-2015-0839

The hp-plugin utility in HP Linux Imaging and Printing HPLIP makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads...

Moderate: Red Hat Security Advisory: python security and bug fix update

An update for python is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

McAfee Security Scan Plus - Remote Command Execution

McAfee Security Scan Plus - Remote Command Execution Vulnerability Summary The following advisory describes a Remote Code Execution found in McAfee Security Scan Plus. An active network attacker could launch a man-in-the-middle attack on a plaintext-HTTP response to a client to run any residing...

CVE-2017-2834

An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted server response can cause an out-of-bounds write resulting in an exploitable condition. An attacker can compromise the server or use a man in the middle...

[ASA-201707-24] rkhunter: arbitrary code execution

Arch Linux Security Advisory ASA-201707-24 ========================================== Severity: High Date : 2017-07-18 CVE-ID : CVE-2017-7480 Package : rkhunter Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-334 Summary ======= The package rkhunter before...

Missing Certificate Verfication

txAWS is missing certificate verification. The library does not properly verify TLS Certificates, allowing a self-signed, expired and mismatched certificate to communicate with the TLS server This can lead to a man-in-the-middle attack or information disclosure...

Debian: Security Advisory (DSA-3912-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-11318

CVE-2017-11318 affects Cobian Backup 11 client. The vulnerability allows a man-in-the-middle attacker to spoof the master server and add/execute new backup tasks, and to run system commands remotely by abusing pre-backup events. Connected sources (CNVD/NVD entries) corroborate the remote executio...

MGASA-2017-0204 Updated nodejs packages fix security vulnerability

Node.js has a defect that may make HTTP response splitting possible under certain circumstances. If user-input is passed to the reason argument to writeHead on an HTTP response, a new-line character may be used to inject additional responses CVE-2016-5325. The tls.checkServerIdentity function in...