JVN#75307484: RICOH Streamline NX vulnerable to tampering with operation history

RICOH Streamline NX provided by Ricoh Company, Ltd. contains the following vulnerability. Use of Less Trusted Source CWE-348 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 2.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 3.1 CVE-2025-58422 Impact If an...

PT-2025-36367

Name of the Vulnerable Software and Affected Versions TP-Link AX10 versions prior to 1.2.1 TP-Link AX1500 versions prior to 1.3.11 Description A flaw exists in the CWMP CWMP/TR-069 binary of TP-Link AX10 and AX1500 routers that could allow an authenticated attacker to remotely execute arbitrary...

An unintended cleartext issue exists in Go before 1.8.4 and 1.9.x before 1.9.1. RFC 4954 requires that, during SMTP, the PLAIN auth scheme must only be used on network connections secured with TLS. The original implementation of smtp.PlainAuth in Go 1.0 enforced this requirement, and it was documented to do so. In 2013, upstream issue #5184, this was changed so that the server may decide whether PLAIN is acceptable. The result is that if you set up a man-in-the-middle SMTP server that doesn't advertise STARTTLS and does advertise that PLAIN auth is OK, the smtp.PlainAuth implementation sends the username and password.

...

CVE-2025-9785

PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment and management. When the component is deployed to an environment, the customer has an option to configure the system to use a self-signed certificate. If the customer does not...

PT-2025-35658

Name of the Vulnerable Software and Affected Versions: PaperCut Print Deploy affected versions not specified Description: PaperCut Print Deploy, an optional component integrated with PaperCut NG/MF, is susceptible to man-in-the-middle attacks if not correctly configured with a trusted certificate...

CVE-2025-35115

Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30...

httpd: HTTP Session Hijack via a TLS upgrade

An HTTP session hijacking flaw was found in Apache httpd. In some modssl configurations on Apache HTTP Server, an HTTP desynchronization attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade...

CVE-2025-58123

Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic...

CVE-2025-58124

Improper Certificate Validation in Checkmk Exchange plugin check-mk-api allows attackers in MitM position to intercept traffic...

CVE-2025-58127 Lack of TLS validation in plugin Dell Powerscale on Checkmk Exchange

Improper Certificate Validation in Checkmk Exchange plugin Dell Powerscale allows attackers in MitM position to intercept traffic...

CVE-2025-58126 Lack of TLS validation in plugin VMware vSAN on Checkmk Exchange

Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic...

CVE-2025-58123 Lack of TLS validation in plugin BGP Monitoring on Checkmk Exchange

Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic...

Checkmk Exchange plugin Freebox v6 agent 安全漏洞

Checkmk Exchange plugin Freebox v6 agent is a plugin for device status monitoring from Checkmk Germany. A security vulnerability exists in Checkmk Exchange plugin Freebox v6 agent that stems from improper certificate validation and could lead to a man-in-the-middle attacker intercepting traffic...

CVE-2025-35115

Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30...

CVE-2025-35115 Agiloft insecure download of system packages

Agiloft Release 28 downloads critical system packages over an insecure HTTP connection. An attacker in a Man-In-the-Middle position could replace or modify the contents of the download URL. Users should upgrade to Agiloft Release 30...

Linux Distros Unpatched Vulnerability : CVE-2021-3565

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in tpm2-tools in versions before 5.1.1 and before 4.3.2. tpm2import used a fixed AES key for the inner wrapper, potentially allowing a MITM...

Linux Distros Unpatched Vulnerability : CVE-2016-2166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The 1 proton.reactor.Connector, 2 proton.reactor.Container, and 3 proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an...

Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities

Summary IBM QRadar SIEM includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. These have been addressed in the update. Vulnerability Details CVEID:CVE-2024-22365 DESCRIPTION: Linux-pam is vulnerable to a denial of service, caused by ...

CVE-2024-7402

CVE-2024-7402 concerns Netskope Client where a malicious insider with administrative privileges can tamper the client configuration via a local MITM on the client-channel. Impact per available data includes temporary or permanent configuration changes and possible removal of the agent, with CVSS ...

ZKTeco WL20 信任管理问题漏洞

The ZKTeco WL20 is an intelligent fingerprint time and attendance machine from China's Entropy Base Technology ZKTeco. The ZKTeco WL20 suffers from a trust management issue vulnerability that stems from a hard-coded private key stored in the device firmware, which could allow a physical access...