CVE-2024-36279

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a...

CVE-2024-36289

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a man-in-the-middle attack...

CVE-2024-36289

CVE-2024-36289 concerns FreeFrom - the nostr client prior to version 1.3.5. The vulnerability arises from reusing a nonce/key pair in encryption, enabling a man-in-the-middle to potentially manipulate the content of direct messages (DMs) between users. Affected platforms include Android and iOS a...

CVE-2024-36289

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a man-in-the-middle attack...

CVE-2024-36279

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a...

CVE-2024-36279

CVE-2024-36279 concerns “FreeFrom - the nostr client” (Android/iOS) versions prior to 1.3.5. The issue is reliance on obfuscation or encryption of security‑relevant inputs without proper integrity checking, enabling a man‑in‑the‑middle to manipulate the content of Direct Messages (DMs). The vulne...

CVE-2024-21988

StorageGRID formerly StorageGRID Webscale versions prior to 11.7.0.9 and 11.8.0.5 are susceptible to disclosure of sensitive information via complex MiTM attacks due to a vulnerability in the SSH cryptographic implementation...

Fortinet FortiClient Telemetry protocol is vulnerable to a MitM (FG-IR-21-075)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-075 advisory. - A combination of a use of hard-coded cryptographic key vulnerability CWE-321 in FortiClientEMS 7.0.1 and below, 6.4.6 and...

Fortinet FortiClient Telemetry protocol is vulnerable to a MitM (FG-IR-21-075) (macOS)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-075 advisory. - A combination of a use of hard-coded cryptographic key vulnerability CWE-321 in FortiClientEMS 7.0.1 and below, 6.4.6 and...

Amazon Linux 2 : ruby (ALAS-2024-2570)

The version of ruby installed on the remote host is prior to 2.0.0.648-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2570 advisory. An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception...

OpenSSL 0.9.7 < 0.9.7h Vulnerability

The version of OpenSSL installed on the remote host is prior to 0.9.7h. It is, therefore, affected by a vulnerability as referenced in the 0.9.7h advisory. - The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option,...

The vulnerability of the MileSight DeviceHub deployment platform, related to key management errors, allows a violator to carry out a “man-in-the-middle” attack.

The vulnerability of the MileSight DeviceHub deployment platform is related to key management errors. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...

OpenSSL 0.9.8 < 0.9.8a Vulnerability

The version of OpenSSL installed on the remote host is prior to 0.9.8a. It is, therefore, affected by a vulnerability as referenced in the 0.9.8a advisory. - The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option,...

JVN#55045256: Multiple vulnerabilities in "FreeFrom - the nostr client" App

"FreeFrom - the nostr client" App provided by FreeFrom K.K. contains multiple vulnerabilities listed below. Improper verification of cryptographic signature CWE-347 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Base Score 5.3 CVE-2024-36277 Reliance on obfuscation or encryption of security-relevan...

The vulnerability of the “nimble refresh” function in the Nimble programming language’s package manager allows attackers to execute a “man-in-the-middle” attack or execute arbitrary code.

The vulnerability of the “nimble refresh” function in the Nimble programming language package manager is related to the lack of checks on the loaded packages due to an error in the authentication process. Exploiting this vulnerability allows a malicious actor to execute a “man-in-the-middle” atta...

BIT-HUBBLE-2024-28860

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...

RHEL 7 : pywbem (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - pywbem: failure to check certificate hostname CVE-2013-6444 - PyWBEM 0.7 and earlier uses a separate...

RHEL 6 : mercurial (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mercurial: arbitrary command execution in mercurial repo with a git submodule CVE-2017-17458 - mercurial:...

RHEL 5 : gnutls (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - gnutls: Heap read overflow in read-packet.c CVE-2017-5337 - The TLS protocol 1.2 and earlier, as used in...

RHEL 8 : mutt (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - mutt: TLS mishandling during connection CVE-2020-14154 - mutt: response Injection via STARTTLS in SMTP,...