Synology DiskStation Manager (DSM) Multiple Vulnerabilities (Synology-SA-25:01, Synology-SA-25:03) - Unreliable Remote Version Check

Synology DiskStation Manager DSM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Synology DiskStation Manager (DSM) Multiple Vulnerabilities (Synology-SA-25:01, Synology-SA-25:03) - Remote Known Vulnerable Versions Check

Synology DiskStation Manager DSM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security update for openssh

This update for openssh fixes the following issues: CVE-2025-26465: Fixed a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client bsc1237040. Add a s390 specific ioctl for ECC hardware support bsc1225637: for migration to openssh 8.4: write active/enabled switch over files only if not yet...

CVE-2025-1001 Medixant RadiAnt DICOM Viewer Improper Certificate Validation

Medixant RadiAnt DICOM Viewer is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to alter network traffic and carry out a machine-in-the-middle attack MITM. An attacker could modify the server's response and deliver a...

PT-2025-7482 · Medixant · Medixant Radiant Dicom Viewer

Name of the Vulnerable Software and Affected Versions: Medixant RadiAnt DICOM Viewer affected versions not specified Description: The issue is due to the failure of the update mechanism to verify the update server's certificate, which could allow an attacker to alter network traffic and carry out...

Devolutions Remote Desktop < 2024.3.20.0 Improper Certificate Validation (DEVO-2025-0001)

The version of Devolutions Remote Desktop Manager installed on the remote host is prior to 2024.3.20.0 and is, therefore, affected by an improper certificate validation vulnerability: - Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on...

CVE-2025-25305

Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

BIT-CASSANDRA-2024-27137 Apache Cassandra: unrestricted deserialization of JMX authentication credentials

In Apache Cassandra it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these...

OpenSSH < 9.9p2 MitM

The version of OpenSSH installed on the remote host is prior to 9.9p2. It is, therefore, affected by a man in the middle MITM vulnerability. ssh1 in OpenSSH versions 6.8p1 to 9.9p1 inclusive contained a logic error that allowed an on-path attacker a.k.a MITM to impersonate any server when the...

The vulnerability of the IBM QRadar SIEM system, related to the transmission of critical information in plaintext, allows a perpetrator to execute a “man-in-the-middle” type attack.

The vulnerability of the IBM QRadar SIEM event collection and analysis system is related to the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor to execute a “man-in-the-middle” type attack...

[slackware-security] openssh

New openssh packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/openssh-9.9p2-i586-1slack15.0.txz: Upgraded. This release fixes two security bugs: ssh1 in OpenSSH versions 6.8p1 to 9.9p1 inclusive...

Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

Summary Problem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. Details In the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...

GHSA-M3PM-RPGG-5WJ6 Home Assistant does not correctly validate SSL for outgoing requests in core and used libs

Summary Problem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. Details In the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In...

ALPINE-CVE-2025-26465

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. Fo...

CVE-2025-25305

Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

CVE-2025-25305 SSL validation for outgoing requests in Home Assistant Core and used libs not correct

Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

CVE-2025-25305

CVE-2025-25305 affects Home Assistant Core and libraries it uses, with a root cause of missing SSL certificate verification in outgoing requests. The issue stems from migrating the legacy verify_ssl parameter to the newer ssl parameter, which in some cases could leave request.ssl = True and disab...

CVE-2025-26465

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. Fo...

Critical OpenSSH Vulnerabilities Expose Users to MITM and DoS Attacks

Two critical OpenSSH vulnerabilities discovered! Qualys TRU finds client and server flaws CVE-2025-26465 & CVE-2025-26466 enabling MITM and…...

New OpenSSH Flaws Enable Man-in-the-Middle and DoS Attacks — Patch Now

Two security vulnerabilities have been discovered in the OpenSSH secure networking utility suite that, if successfully exploited, could result in an active machine-in-the-middle MitM and a denial-of-service DoS attack, respectively, under certain conditions. The vulnerabilities, detailed by the...