Siemens Scalance W-7xx Series Hard-coded SSL Certificate (CVE-2013-4651)

Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the- middle attacks against SSL sessions by leveraging the certificate's trust relationship. Th...

PT-2023-7378 · Fortinet · Fortiguard +2

Name of the Vulnerable Software and Affected Versions: FortiAnalyzer and FortiManager versions 6.4.8 through 6.4.10 FortiAnalyzer and FortiManager versions 7.0.0 through 7.0.5 FortiAnalyzer and FortiManager versions 7.2.0 through 7.2.1 Description: The issue is related to an improper certificate...

FortiAnalyzer & FortiManager - Lack of client-side certificate validation when establishing secure connections with FortiGuard to download outbreakalert

An improper certificate validation vulnerability CWE-295 in FortiAnalyzer and FortiManager may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and the remote FortiGuard server hosting outbreakalert ressources...

PT-2023-2394 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to an insecure implementation of the Kerberos protocol in Windows, specifically involving the use of the RC4 encryption algorithm with the MD4 hash function. This can b...

CVE-2023-26467

A man in the middle can redirect traffic to a malicious server in a compromised configuration...

CVE-2023-26467

Technical details about CVE-2023-26467 are not publicly available in the provided documents; monitor for updates.

PT-2023-20043

Name of the Vulnerable Software and Affected Versions Allegro Tech BigFlow versions prior to 1.6.0 Description The issue is related to Missing SSL Certificate Validation. This means that the software may not properly verify the identity of the server it is connecting to, potentially allowing for...

Security Bulletin: Vulnerabilities in OpenSSL affect IBM InfoSphere Information Server

Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM InfoSphere Information Server. IBM InfoSphere Information Server has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-6306 DESCRIPTION: OpenSSL is...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : libgit2 (SUSE-SU-2023:1788-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1788-1 advisory. - CVE-2023-22742: Verify ssh remote host keys bsc1207364 Tenable has extracted the preceding description...

CVE-2020-10134

A flaw was discovered in the Bluetooth protocol affecting the Bluetooth LE Secure Connections pairing and the BR/EDR Secure Simple Pairing. An attacker with physical access to the Bluetooth connection could perform a man-in-the-middle attack between two devices using the Numeric Comparison and...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl (CVE-2022-32208)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a man-in-the-middle attack in cURL libcurl caused by a flaw in the handling of message verification failures. CVE-2022-32208. cURL libcurl is included as part of the Base OS used by our service images. Please...

The vulnerability of the queue formation mechanism for bufferring frames in Wi-Fi packet buffering technology, which is related to the use of weak encryption, allows attackers to execute a type of “man-in-the-middle” attack.

The vulnerability of the mechanism for scheduling buffer allocations for Wi-Fi packet buffering technology is related to the use of weak encryption. Exploiting this vulnerability could allow a remote attacker to carry out a “man-in-the-middle” attack...

Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family (CVE-2011-3389)

Summary Security Bulletin: Vulnerabilities in SSL and TLS protocols affects SAN Volume Controller and Storwize Family CVE-2011-3389 Vulnerability Details Security Bulletin --- Summary --- SSL and TLS vulnerabilities were disclosed in September 2011. This vulnerability has been referred to as the...

Security Bulletin: OpenSSL vulnerability in IBM SAN Volume Controller and Storwize Family (CVE-2014-0224)

Summary Security vulnerability in OpenSSL Vulnerability Details CVEID: CVE-2014-0224 DESCRIPTION : SSL/TLS MITM vulnerability An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects IBM SAN Volume Controller and Storwize Family (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects IBM SAN Volume Controller and Storwize Family Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by th...

Revoked 'known_hosts' SSH Key Detection (Linux/Unix SSH Login)

The remote host is using a revoked SSH keys in a SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: TS2900 is affected by the following OpenSSL vulnerabilities: CVE-2014-0224

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details CVE-2014-0224 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack, caused by the use of weak keying material in SSL/TLS clients and server...

openSUSE 15 Security Update : libgit2 (SUSE-SU-2023:1570-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:1570-1 advisory. - CVE-2023-22742: Fixed SSH keys verification failure bsc1207364. Tenable has extracted the preceding description block directly from the SUSE security...

CVE-2023-22812

SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromising confidentiality and integrity of data...

Code injection

SanDisk PrivateAccess versions prior to 6.4.9 support insecure TLS 1.0 and TLS 1.1 protocols which are susceptible to man-in-the-middle attacks thereby compromising confidentiality and integrity of data...