CVE-2015-4456

ownCloud Desktop Client before 1.8.2 does not call QNetworkReply::ignoreSslErrors with the list of errors to be ignored, which allows man-in-the-middle attackers to bypass the user's certificate distrust decision and obtain sensitive information by leveraging a self-signed certificate and a...

CVE-2015-5014

IBM Cognos Disclosure Management CDM 10.1.x and 10.2.x before 10.2.4 IF10 allows man-in-the-middle attackers to obtain access by spoofing an executable file during a client upload operation...

MGASA-2015-0413 Updated ntp packages fixes security vulnerabilities

It was found that ntpd did not correctly implement the threshold limitation for the '-g' option, which is used to set the time without any restrictions. A man-in-the-middle attacker able to intercept NTP traffic between a connecting client and an NTP server could use this flaw to force that clien...

[USN-2769-1] Apache Commons HttpClient

========================================================================== Ubuntu Security Notice USN-2769-1 October 14, 2015 commons-httpclient vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its...

How Hackers Can Hack Your Chip-and-PIN Credit Cards

October 1, 2015, was the end of the deadline for U.S. citizens to switch to Chip-enabled Credit Cards for making the transactions through swipe cards safer. Now, a group of French forensics researchers have inspected a real-world case in which criminals played smart in such a way that they did a...

Design/Logic Flaw

AirScan in Apple OS X before 10.11 allows man-in-the-middle attackers to obtain eSCL packet payload data via unspecified vectors...

Ubuntu: Security Advisory (USN-2746-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-5824

CVE-2015-5824 affects CFNetwork SSL in Apple’s software stack (NSURL) on iOS before 9, where certificate verification fails after a certificate change. This enables man-in-the-middle attackers in privileged network positions to spoof servers and obtain data. Root cause: improper validation of X.5...

CVE-2015-5798

CVE-2015-5798 affects WebKit used by Apple iTunes prior to 12.3. The vulnerability arises in iTunes Store browsing and allows a man‑in‑the‑middle to trigger memory corruption and potentially arbitrary code execution or a denial-of-service (application crash). Affected product: Apple iTunes before...

CVE-2015-5815

CVE-2015-5815 affects WebKit as used in Apple iTunes prior to version 12.3. The vulnerability arises in iTunes Store browsing vectors, allowing a man-in-the-middle attacker to cause memory corruption, leading to arbitrary code execution or a denial of service (application crash). The description ...

MGASA-2015-0336 Updated hplip packages fix CVE-2015-0839

Updated hplip packages fix security vulnerability: It was reported that the hp-plugin utility, included in the hplip package, downloads a binary driver and verifies it via a key specified by the key's short ID. A man-in-the-middle attacker could use this flaw to generate a key with the expected...

MGASA-2015-0342 Updated iceape packages fix security vulnerabilities

Updated iceape packages fix security issues: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to cause a denial of service memory corruption and application crash or possibly...

JVN#81207766: Rakuten card App for iOS fails to verify SSL server certificates

Rakuten card App for iOS provided by Rakuten Card Co., Ltd. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided ...

CVE-2015-5717

The Siemens COMPAS Mobile application before 1.6 for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2015-5717

The CVE-2015-5717 issue affects Siemens COMPAS Mobile application for Android (versions prior to 1.6). The root cause is improper verification of X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. Public de...

Logstash vulnerability CVE-2015-5619

Summary: Logstash 1.5.3 and prior versions are vulnerable to a SSL/TLS security issue which allows an attacker to successfully implement a man in the middle attack. This vulnerability is not present in the initial installation of Logstash. This insecurity is exposed when users configure Lumberjac...

Your GPS Location and Calls Can be Spied Using Network Vulnerability

Yes, you heard it right. It's the dirty truth that’s featuring what is being called the largest privacy breach ever. Billions of cell phone users are at risk of a vulnerability in the SS7 inter-carrier network that allows hackers and spies agencies to track locations and intercept all voice calls...

CVE-2015-3750

CVE-2015-3750 concerns WebKit in WebKit-based components (e.g., Apple Safari, WebKit2) where Content Security Policy report requests did not have enforceable HTTP Strict Transport Security (HSTS). The failing behavior allowed a MITM to sniff sensitive data or spoof CSP report data, including cook...

Code injection

Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

KLA10646 Multiple vulnerabilities in Microsoft Windows

Multiple serious vulnerabilities have been found in Microsoft products. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, execute arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Improper OGL,...