29239 matches found
CVE-2024-41258: Improper Verification of Cryptographic Signature
An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack...
CVE-2024-41254
An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey disables host key verification, possibly allowing attackers to obtain sensitive information via a man-in-the-middle attack...
CVE-2024-41262
mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly allowing attackers to intercept communications via a man-in-the-middle attack...
CVE-2024-41262
The mmudb software, specifically version 1.9.3 , is vulnerable to a man-in-the-middle (MitM) attack because the ShowMetricsRaw and ShowMetricsAsText functions utilize the insecure HTTP protocol. This flaw allows an attacker to intercept communications between the client and the server, potentiall...
SIPROTEC relay protection devices Man-in-the-Middle
The vulnerability of SIPROTEC relay protection devices is related to insufficiently secure data encryption. Exploiting this vulnerability allows a malicious actor, operating remotely, to carry out “man-in-the-middle” attacks using specially crafted packets sent to port 4443/tcp...
Cisco Intelligent Node Man-in-the-Middle
The vulnerability of Cisco Intelligent Node iNode management and optimization software is related to the use of a rigidly encrypted cryptographic key. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information by...
Filestash security vulnerabilities
filestash is a Dropbox-like file manager by the individual developer Mickael. A security vulnerability exists in filestash v0.4, which stems from a TLS certificate validation being skipped when using the FTPS protocol. An attacker can perform a man-in-the-middle attack via the Init function of...
Security Bulletin: IBM Cloud Pak for Data is vulnerable to denial of service due to cURL libcurl ( CVE-2022-32208, CVE-2022-32206 )
Summary cURL libcurl is used by IBM Cloud Pak for Data as part of the platform. CVE-2022-32208, CVE-2022-32206. Vulnerability Details CVEID:CVE-2022-32208 DESCRIPTION: cURL libcurl is vulnerable to a man-in-the-middle attack, caused by a flaw in the handling of message verification failures. An...
ROS-20240729-05
Vulnerability in the libssh2 library of Libgit2's implementation of Git's C methods is related to validation bugs of cryptographic signatures. Exploitation of the vulnerability could allow an attacker acting remotely, execute a man-in-the-middle attack...
Dahua ASI7213X-T1 Generation of Error Message Containing Sensitive Information (CVE-2022-30562)
If the user enables the https function on the device, an attacker can modify the user's request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page. This plugin only works wit...
EulerOS Virtualization 3.0.6.0 : systemd (EulerOS-SA-2024-2066)
According to the versions of the systemd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains ev...
Huawei EulerOS: Security Advisory for systemd (EulerOS-SA-2024-2061)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ROS-20240723-03
Vulnerability of Ruby interpreter's Net::FTP class implementation is related to flaws in service data protection using the PASV command. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information. remotely, to gain unauthorized...
USN-6910-1 activemq vulnerabilities
Chess Hazlett discovered that Apache ActiveMQ incorrectly handled certain commands. A remote attacker could possibly use this issue to terminate the program, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS. CVE-2015-7559 Peter Stöckli discovered that Apache ActiveMQ...
RADIUS Protocol Forgery Vulnerability (Blast-RADIUS)
In early July 2024, a group of security researchers found a vulnerability in the RADIUS protocol:CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by an on-path attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other...
EulerOS 2.0 SP8 : systemd (EulerOS-SA-2024-2061)
According to the versions of the systemd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they ha...
EulerOS 2.0 SP8 : shim (EulerOS-SA-2024-2051)
According to the versions of the shim package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summar...
Unspecified Vulnerability in IBM Sterling B2B Integrator (CNVD-2024-33677)
IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A security vulnerability exists i...
PT-2024-29279
Name of the Vulnerable Software and Affected Versions Puncia versions prior to 0.21 Description The issue arises from API URLS utilizing HTTP instead of HTTPS for communication, leading to potential issues like Eavesdropping, Data Tampering, Unauthorized Data Access, and MITM Attacks...
