CVE-2023-38009 IBM Cognos Analytics Mobile information disclosure

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning...

CVE-2024-50692

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT...

CVE-2024-41757

IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2024-41757

IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2024-41757 IBM Concert Software information disclosure

IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2024-41757

IBM Concert Software 1.0.0–1.0.1 is affected by CVE-2024-41757, where failure to properly enable HTTP Strict Transport Security could allow an attacker to perform MITM and obtain sensitive information. The vulnerability is tied to the product’s HSTS configuration, enabling network-based informati...

Insecure TLS Configuration

aws-cdk-lib is vulnerable to Insecure TLS configuration. The vulnerability is due to the tls.connect method setting rejectUnauthorized: false by default, which allows connections to unauthorized OIDC providers without verification. This could potentially allow attackers to exploit insecure...

PT-2025-2884 · Sungrow · Sungrow Winet-Sv200

Name of the Vulnerable Software and Affected Versions: SunGrow WiNet-SV200 versions 0.001.00.P027 and earlier Description: The issue concerns hardcoded MQTT credentials in the affected software, allowing an attacker to send arbitrary commands to any inverter. Additionally, the lack of TLS to...

CVE-2024-50692

The CVE-2024-50692 entry concerns SunGrow WiNet-SV200.001.00.P027 and earlier versions that ship with hardcoded MQTT credentials, enabling an attacker to send arbitrary commands to an inverter. TLS is not used to identify the MQTT broker, enabling impersonation and making MQTT communications susc...

CVE-2024-12399

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication...

CVE-2024-12399

The CVE-2024-12399 entry concerns Schneider Electric Pro-face GP‑Pro EX and Remote HMI. The underlying issue is improper enforcement of message integrity during transmission in a communication channel, which could enable a man‑in‑the‑middle attack and lead to partial loss of confidentiality, inte...

CVE-2024-12399

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication...

PT-2025-5302 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: visionOS versions prior to 2.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 watchOS versions prior to 11.3 tvOS versions prior to 18.3 Description: A type confusion issue was addressed with...

Man-in-the-middle(MitM) Attack

github.com/notaryproject/notation-go is vulnerable to Man-in-The-Middle attack. The vulnerability is due to the failure to verify the revocation status of the certificate chain during timestamp signature generation, allowing attackers to exploit compromised or revoked certificates to generate...

The vulnerability of theOTP library set in the Erlang programming language allows attackers to carry out “man-in-the-middle” type attacks.

The vulnerability of theOTP library in the Erlang programming language is related to errors in the authentication process for certificates. Exploiting this vulnerability allows attackers who operate remotely to carry out “man-in-the-middle” type attacks...

CVE-2024-48121

The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain access to sensitive information via a man-in-the-middle attack...

CVE-2025-0500

An issue in the native clients for Amazon WorkSpaces when running Amazon DCV protocol, Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle...

CVE-2025-0501

An issue in the native clients for Amazon WorkSpaces when running PCoIP protocol may allow an attacker to access remote sessions via man-in-the-middle...

CVE-2025-0501 Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)

An issue in the native clients for Amazon WorkSpaces when running PCoIP protocol may allow an attacker to access remote sessions via man-in-the-middle...

CVE-2025-0501

CVE-2025-0501 affects the native Amazon WorkSpaces clients (PCoIP) and is described as allowing an attacker to access remote sessions via man‑in‑the‑middle, due to a trust management issue (as noted by multiple sources). The issue is associated with high impact across confidentiality, integrity, ...