PT-2024-34364

Name of the Vulnerable Software and Affected Versions: KDE Kmail versions prior to 6.2.0 Description: The issue allows man-in-the-middle attackers to trigger the use of an attacker-controlled mail server. This is because cleartext HTTP is used for retrieving configuration from URLs such as...

PT-2024-8827

Name of the Vulnerable Software and Affected Versions: Wget versions prior to 1.25.0 Description: The issue is related to insufficient validation of requests on the server side, allowing attackers to exploit Wget's shorthand URL handling. This can lead to Server-Side Request Forgery SSRF attacks,...

CVE-2024-50624

ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because cleartext HTTP is used for a URL such as http://autoconfig.example.com or http://example.com/.well-known/autoconfig for retrieving the configuration. This is...

Fortinet Fortigate Lack of certificate verification when establishing secure connections to external end-points (FG-IR-21-239)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-239 advisory. - An improper certificate validation vulnerability CWE-295 in FortiOS 6.0.0 through 6.0.14, 6.2.0 through 6.2.10, 6.4.0 throu...

Fortinet Fortigate Lack of certificate verification when establishing secure connections (FG-IR-18-292)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-18-292 advisory. - An improper certificate validation vulnerability CWE-295 in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer...

CVE-2024-47023

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-47023

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-47023

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-47023

CVE-2024-47023 is an elevation-of-privilege in the Pixel modem due to a logic error in the code. The vulnerability could allow remote escalation with no user interaction. Pixel bulletin entries show the issue as EoP in the Modem subcomponent and indicate that applying security patch level 2024-10...

CVE-2024-47023: Undefined Security Weakness

there is a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-32351

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned. Description The issue is related to a possible man-in-the-middle attack due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges...

CVE-2024-40595

An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions SPS On Premise before 7.5.1 and LTS before 7.0.5.1 allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol informatio...

CVE-2024-40595: Cleartext Transmission of Sensitive Information

An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions SPS On Premise before 7.5.1 and LTS before 7.0.5.1 allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol informatio...

PT-2024-28931

Name of the Vulnerable Software and Affected Versions One Identity Safeguard for Privileged Sessions SPS On Premise versions prior to 7.5.1 One Identity Safeguard for Privileged Sessions SPS On Premise LTS versions prior to 7.0.5.1 Description An authentication-bypass issue in the RDP component...

CVE-2024-40595

An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions SPS On Premise before 7.5.1 and LTS before 7.0.5.1 allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol informatio...

CVE-2024-40595

An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions SPS On Premise before 7.5.1 and LTS before 7.0.5.1 allows man-in-the-middle attackers to obtain access to privileged sessions on target resources by intercepting cleartext RDP protocol informatio...

CVE-2024-40595

One Identity Safeguard for Privileged Sessions (SPS) On Premise is affected by an authentication-bypass vulnerability in its RDP component . This flaw occurs in versions before 7.5.1 (and LTS before 7.0.5.1 ) because the system allows man-in-the-middle attackers to intercept cleartext RDP protoco...

OESA-2024-2262 systemd security update

systemd is a system and service manager that runs as PID 1 and starts the rest of the system. Security Fixes: A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middl...

CVE-2023-49570

A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software trusts a certificate issued by an entity that isn't authorized to issue certificates. This occurs when the "Basic Constraints" extension in the certificate indicates that it is meant ...

CVE-2023-6055

A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product...