CVE-2024-38325

IBM Storage Defender on‑prem Defender Sensor CLI (versions 2.0.0–2.0.7) may disclose sensitive information due to requests sent over an insecure channel, enabling MITM exposure. Root cause: insecure network handling in defender-sensor-cmd. Impact: potential information disclosure. Affected produc...

Advisory ROSA-SA-2025-2573

Software: qbittorrent 4.6.7 OS: ROSA-CHROME packageevrstring: qbittorrent-4.6.7-1 CVE-ID: CVE-2024-51774 BDU-ID: 2024-09433 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the cross-platform BitTorrent client qBittorrent is related to improper SSL/TLS certificate authentication. Exploitation of the...

Advisory ROSA-SA-2025-2569

software: curl 8.7.1 OS: ROSA-CHROME packageevrstring: curl-8.7.1-2 CVE-ID: CVE-2024-9681 BDU-ID: 2024-09106 CVE-Crit: MEDIUM. CVE-DESC.: A vulnerability exists in the implementation of the HSTS HTTP Strict Transport Security mechanism of the curl command line utility due to a bug in the...

BIT-RUBY-MIN-2021-32066

An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between th...

CVE-2024-26317

In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the algorithm to yield a result of POINTATINFINITY when it should not. A man-in-the-middle attacker could use this to interfere with a connection...

CVE-2024-26317

In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the algorithm to yield a result of POINTATINFINITY when it should not. A man-in-the-middle attacker could use this to interfere with a connection...

CVE-2024-38325: Missing Encryption of Sensitive Data

IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI could allow a remote attacker to obtain sensitive information, caused by sending network requests over an insecure channel. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

CVE-2024-26317: Use of a Broken or Risky Cryptographic Algorithm

In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates, causing the algorithm to yield a result of POINTATINFINITY when it should not. A man-in-the-middle attacker could use this to interfere with a connection...

CVE-2024-26317

A cryptographic vulnerability exists in illumos illumos-gate 2024-02-15 due to an error in the elliptic curve point addition algorithm when using mixed Jacobian-affine coordinates. This flaw causes the algorithm to incorrectly yield a result of POINT_AT_INFINITY , which a man-in-the-middle attack...

CVE-2023-38009

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning...

CVE-2023-38009 IBM Cognos Analytics Mobile information disclosure

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning...

CVE-2023-38009 IBM Cognos Analytics Mobile information disclosure

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning...

CVE-2023-38009: Improper Certificate Validation

IBM Cognos Mobile Client 1.1 iOS may be vulnerable to information disclosure through man in the middle techniques due to the lack of certificate pinning...

CVE-2024-50692

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT...

CVE-2024-41757

IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2024-41757

IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2024-41757

IBM Concert Software 1.0.0–1.0.1 is affected by CVE-2024-41757, where failure to properly enable HTTP Strict Transport Security could allow an attacker to perform MITM and obtain sensitive information. The vulnerability is tied to the product’s HSTS configuration, enabling network-based informati...

CVE-2024-41757 IBM Concert Software information disclosure

IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Insecure TLS Configuration

aws-cdk-lib is vulnerable to Insecure TLS configuration. The vulnerability is due to the tls.connect method setting rejectUnauthorized: false by default, which allows connections to unauthorized OIDC providers without verification. This could potentially allow attackers to exploit insecure...

CVE-2024-41757: Cleartext Transmission of Sensitive Information

IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...