CVE-2022-30307

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

Design/Logic Flaw

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

CVE-2022-30307

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthenticated attacker to perform a man in the middle attack...

Vulnerabilities fixed in FortiOS

FortiNet has fixed vulnerabilities in FortiOS. A malicious party could exploit the vulnerabilities to gain access to system data, potentially manipulate it, or launch a Man-in-the-Middle attack. To manipulate system data, the malicious party needs need prior authentication. For performing a...

CVE-2022-30307

CVE-2022-30307 affects FortiOS RSA SSH host key handling. Affected versions: FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below. Root cause is a key management error (CWE-320) that may enable an unauthenticated attacker to perform a Man-in-the-Middle (MITM) attack by abusing the RSA SSH ho...

Protect

A key management error vulnerability CWE-320 affecting the RSA SSH host key in FortiOS may allow an unauthenticated attacker to perform a man in the middle attack...

The vulnerability affects the implementation of URL/SPAM/AV filtering in FortiOS and Fortinet’s FortiClient for Windows and FortiClient for Mac security solutions. This allows attackers to execute a type of “man-in-the-middle” attack.

The vulnerability of the URL/SPAM/AV filtering implementations in FortiOS and Fortinet’s FortiClient for Windows and FortiClient for Mac systems is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker to execute a type of...

F5 Networks BIG-IP : OpenSSH client vulnerability (K48050136)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by a vulnerability as referenced in the K48050136 advisory. The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in th...

CVE-2022-29475

An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this...

CVE-2022-29475

An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted man-in-the-middle attack can lead to increased privileges. An attacker can perform a man-in-the-middle attack to trigger this...

CVE-2022-29475

CVE-2022-29475 affects Abode Systems iota All-In-One Security Kit by way of the XFINDER service on UDP/55030. Talos confirms an information disclosure vulnerability that enables an attacker to replay credentials (the Auth field) after observing XFINDER traffic, enabling an authentication bypass a...

CVE-2021-4228

Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle MitM attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0...

Hardcoded credentials

Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle MitM attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0...

Lanner IAC-AST2500A 信任管理问题漏洞

The Lanner IAC-AST2500A is a module and accelerator card from Lanner. It is suitable for Lanner network devices to support remote management and monitoring of system operation based on the IPMI standard. A trust management issue vulnerability exists in the Lanner IAC-AST2500A standard firmware...

CVE-2021-4228 Hard-coded TLS Certificate

Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle MitM attacks even in the presence of the HTTPS connection. This issue affects: Lanner Inc IAC-AST2500A standard firmware version 1.00.0...

Security Bulletin: A security vulnerability inPostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management

Summary A security vulnerability inPostgreSQL affects IBM Cloud Pak for Multicloud Management Infrastructure Management Vulnerability Details CVEID:CVE-2021-23222 DESCRIPTION: PostgreSQL is vulnerable to a man-in-the-middle attack, caused by improper validation of user-supplied input by libpq. A...

SUSE-SU-2022:3691-1 Security update for bluez

This update for bluez fixes the following issues: - CVE-2019-8921: Fixed heap-based buffer overflow via crafted request bsc1193237. - CVE-2019-8922: Fixed heap-based buffer overflow via crafted request bsc1193227. - CVE-2020-26558: Fixed vulnerability that may permit a nearby man-in-the-middle...

SUSE-SU-2022:3687-1 Security update for bluez

This update for bluez fixes the following issues: - CVE-2021-0129: Fixed improper access control bsc1186463. - CVE-2020-26558: Fixed vulnerability that may permit a nearby man-in-the-middle attacker to identify the Passkey bsc1186463. - CVE-2019-8921: Fixed heap-based buffer overflow via crafted...

Security Bulletin: IBM Sterling Order Management migration strategy to Apache Log4j vulnerability (see CVEs below)

Summary Apache Log4j is used by IBM Sterling Order Management as part of its logging utility and we strongly recommend upgrading to the latest supported version of log4j that was released as part of the latest FixPack. Vulnerability Details CVEID:CVE-2020-9488 DESCRIPTION: Apache Log4j is...

Abode Systems, Inc. iota All-In-One Security Kit XFINDER information disclosure vulnerability

Talos Vulnerability Report TALOS-2022-1553 Abode Systems, Inc. iota All-In-One Security Kit XFINDER information disclosure vulnerability October 20, 2022 CVE Number CVE-2022-29475 SUMMARY An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota...