CVE-2024-39886

CVE-2024-39886 affects TONE store App versions 3.4.2 and earlier. Multiple connected sources confirm a cleartext channel between the TONE store App and the TONE store website, enabling a man-in-the-middle attack to obtain and/or alter communications of the affected app. Root cause is unprotected ...

CVE-2024-39886

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App...

PT-2024-28710 · Unknown · Tone Store App

Name of the Vulnerable Software and Affected Versions: TONE store App versions 3.4.2 and earlier Description: The issue is related to an unprotected primary channel in the TONE store App, which communicates with the TONE store website in cleartext. This could allow a man-in-the-middle attack,...

Fortinet FortiWeb ] Lack of client-side certificate validation when establishing secure connections (FG-IR-22-326)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-326 advisory. - An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions...

CVE-2024-39698

The CVE-2024-39698 entry concerns a Windows code-signing bypass in electron-updater. A flaw in the verification routine in packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts arises because the surrounding shell (cmd.exe) expands environment variables in the command line, enab...

CVE-2024-39698 Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6

electron-updater allows for automatic updates for Electron apps. The file packages/electron-updater/src/windowsExecutableCodeSignatureVerifier.ts implements the signature validation routine for Electron applications on Windows. Because of the surrounding shell, a first pass by cmd.exe expands any...

CVE-2024-33509

An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the...

CVE-2024-33509

An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the...

CVE-2023-50179

An improper certificate validation vulnerability CWE-295 in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors...

CVE-2023-50178

An improper certificate validation vulnerability CWE-295 in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication...

CVE-2023-50178

An improper certificate validation vulnerability CWE-295 in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication...

CVE-2023-50178

An improper certificate validation vulnerability CWE-295 in FortiADC 7.4.0, 7.2.0 through 7.2.3, 7.1 all versions, 7.0 all versions, 6.2 all versions, 6.1 all versions and 6.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication...

CVE-2023-50179

An improper certificate validation vulnerability CWE-295 in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors...

CVE-2023-50179

FortiADC exposes an improper certificate validation vulnerability (CWE-295) affecting FortiADC versions 7.0–7.4.0, per NVD/Red Hat and PT-(Security) entries. A remote, unauthenticated attacker could leverage this to perform a Man-in-the-Middle attack on the channel between the FortiADC device and...

CVE-2023-50179

An improper certificate validation vulnerability CWE-295 in FortiADC 7.4.0, 7.2 all versions, 7.1 all versions, 7.0 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN connectors...

CVE-2024-33509

CVE-2024-33509 is an improper certificate validation (CWE-295) vulnerability in FortiWeb. A remote, unauthenticated attacker in a MITM position could decipher and/or tamper with the communication channel between FortiWeb and endpoints used to fetch WAF data. Affected FortiWeb versions include 6.3...

CVE-2024-33509

An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the...

CVE-2024-33509

An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions and 6.3 all versions may allow a remote and unauthenticated attacker in a Man-in-the-Middle position to decipher and/or tamper with the communication channel between the...

CVE-2024-38867

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions V9.64, SIPROTEC 5 6MD85 CP200 All versions, SIPROTEC 5 6MD85 CP300 All versions V9.64, SIPROTEC 5 6MD86 CP200 All versions, SIPROTEC 5 6MD86 CP300 All versions V9.64, SIPROTEC 5 6MD89 CP300 All versions V9.64, SIPROTEC 5...

CVE-2024-38867

CVE-2024-38867 affects Siemens SIPROTEC 5 devices with weak encryption/ciphers on multiple ports (443/tcp web, 4443/tcp DIGSI 5, and a configurable TLS syslog port). The issue enables a remote attacker in a man‑in‑the‑middle to read/modify data across these connections. Affected families include ...