28838 matches found
CVE-2025-55039: Improper Verification of Cryptographic Signature
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true it is set to false by default, but...
PT-2025-42394
Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2025.3.3 Description A flaw exists in Devolutions Server where improper certificate validation occurs when connecting to gateways. This allows attackers in a Man-in-the-Middle MitM position to intercept...
PT-2025-43739
Impact The GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks. The GeoIP processor included a custom SSL implementation that...
The vulnerability of the software for monitoring and analyzing network traffic in industrial networks, SINEC Traffic Analyzer, arises from the ability to access the channel from a non-endpoint location, allowing attackers to carry out “man-in-the-middle” attacks.
The vulnerability of the SINEC Traffic Analyzer software for monitoring and analyzing network traffic in industrial networks lies in the ability to access the channel from a point that is not a final destination. Exploiting this vulnerability could allow an attacker to execute a “man-in-the-middl...
OpenSearch Data Prepper 信任管理问题漏洞
OpenSearch Data Prepper is a component of the OpenSearch project, an OpenSearch open source project. A trust management issue vulnerability exists in OpenSearch Data Prepper versions prior to 2.12.2 that stems from the OpenSearch sink and source plugins trusting all SSL certificates by default,...
EUVD-2025-34241
An Improper Validation of Certificate with Host Mismatch vulnerability CWE-297 in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow a...
CVE-2025-25253
An Improper Validation of Certificate with Host Mismatch vulnerability CWE-297 in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow a...
EUVD-2025-34146
An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...
CVE-2025-25253: Improper Validation of Certificate with Host Mismatch
An Improper Validation of Certificate with Host Mismatch vulnerability CWE-297 in FortiProxy version 7.6.1 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions and FortiOS version 7.6.2 and below, version 7.4.8 and below, 7.2 all versions, 7.0 all versions ZTNA proxy may allow a...
ZTNA Server Improper Certificate Validation
...
EUVD-2025-34056
Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network...
CVE-2025-8915 Hardcoded TLS private key in Kiloview N30 firmware
Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network...
CVE-2025-8915 Hardcoded TLS private key in Kiloview N30 firmware
Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network...
Navigating the Dual-Use Nature and Security Implications of Reconfigurable Intelligent Surfaces in Next-Generation Wireless Systems
Reconfigurable intelligent surface RIS technology offers significant promise in enhancing wireless communication systems, but its dual-use potential also introduces substantial security risks. This survey explores the security implications of RIS in next-generation wireless networks. We first...
Kiloview N30 安全漏洞
Kiloview N30 is an NDI encoder from Kiloview UK. A security vulnerability exists in the Kiloview N30 version 2.02.246, which stems from the inclusion of hard-coded TLS private keys and certificates in the firmware, which could lead to a man-in-the-middle attack...
The vulnerability of the microprogrammed software of the TRC-2190 series media converters, related to the use of a rigidly encrypted cryptographic key, allows attackers to perform a type of “man-in-the-middle” attack.
The vulnerability of the microprogrammed media converters of the TRC-2190 series is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker operating remotely to carry out a “man-in-the-middle” attack by using a publicly accessible, secr...
CVE-2025-8915: Exposure of Sensitive Information to an Unauthorized Actor
Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network...
MongoDB Rust Driver 安全漏洞
MongoDB Rust Driver is a MongoDB open source client library that allows Rust programs to connect to MongoDB databases. A security vulnerability exists in MongoDB Rust Driver versions prior to v3.2.5 that stems from disabling certificate validation, which could lead to a man-in-the-middle attack...
Man-In-The-Middle Proof-Of-Concept Via Krontiris' Ephemeral Diffie-Hellman over COSE (EDHOC) in C
This report presents some technical details on the authentication process of a lightweight key exchange protocol, paying attention on how Man-in-the-Middle MitM attacks could undermine its security, e.g., under the scope of lawful interception and its risk to facilitate mass surveillance. We focu...