CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...

CVE-2022-39264

CVE-2022-39264 affects the nheko desktop client for Matrix; all releases prior to 0.10.2 are vulnerable because homeservers can insert malicious secrets, enabling potential man‑in‑the‑middle attacks. The recommended fix is upgrading to v0.10.2. Workarounds mentioned include applying patches manua...

Apache Pulsar Trust Management Issue Vulnerability

Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, with strong consistency, high...

PT-2022-24854 · Nheko · Nheko

Name of the Vulnerable Software and Affected Versions: nheko versions prior to 0.10.2 Description: nheko is a desktop client for the Matrix communication application. The issue allows homeservers to insert malicious secrets, which could lead to man-in-the-middle attacks. Recommendations: For...

CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...

The vulnerability of the Ethernet encapsulation protocol lies in its ability to combine headers, which allows attackers to trigger a service failure or execute a Middleware Interception Attack (MITM).

The vulnerability of the Ethernet encapsulation protocol lies in the ability to combine headers. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures or execute a “Man-in-the-Middle” attack...

Ubuntu 16.04 ESM : PostgreSQL vulnerabilities (USN-5645-1)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5645-1 advisory. Jacob Champion discovered that PostgreSQL incorrectly handled SSL certificate verification and encryption. A remote attacker could possibly use this issu...

CVE-2022-39264 nheko vulnerable to secret poisoning using MITM on secret requests by the homeserver

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...

CVE-2022-39264

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...

CVE-2022-39264

nheko is a desktop client for the Matrix communication application. All versions below 0.10.2 are vulnerable homeservers inserting malicious secrets, which could lead to man-in-the-middle attacks. Users can upgrade to version 0.10.2 to protect against this issue. As a workaround, one may apply th...

Apache Pulsar Trust Management Issues Vulnerability

Apache Pulsar is the United States Apache Apache Foundation for cloud environments, set of messages, storage, lightweight functional computing as one of the distributed message flow platform. The software supports multi-tenancy, persistent storage, multi-machine room cross-region data replication...

Apache Pulsar Trust Management Issue Vulnerability

Apache Pulsar is an Apache Foundation distributed messaging platform for cloud environments that integrates messaging, storage, and lightweight functional computing. The software supports multi-tenancy, persistent storage, multi-room cross-regional data replication, and highly scalable streaming...

Man-in-the-Middle (MitM)

org.apache.pulsar:pulsar-proxy is vulnerable to man-in-the-middle attacks. The exploitation of this vulnerability is possible because of the delayed TLS hostname verification, which allows a remote attacker to take control of a machine between the client and the server, leading to confidential...

PT-2022-4863 · Cisco · Cisco Ios +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to the implementation of the Ethernet encapsulation protocol, specifically concerning the combination of headers. This could allow ...

Security Advisory 0080

Security Advisory 0080 . CSAF PDF Date: September 28th 2023 Revision | Date | Changes ---|---|--- 1.5 | September 28th 2023 | Update to include 4.29 to EOS Releases that resolve the CVE's 1.4 | January 11th 2023 | Update the fixed release info of NetVisor OS Software 1.3 | October 24th 2022 |...

Security Bulletin: Vulnerability in Transport Layer Security Protocol Used in IBM System Networking Ethernet Switches (CVE-2011-3389)

Abstract Earlier versions of the Transport Layer Security TLS protocol are affected by a publicly disclosed vulnerability that could allow information disclosure if an attacker is carrying out a man-in-the-middle attack. Customers can avoid the vulnerability by following workarounds recommended b...

Security Bulletin: IBM SPSS Modeler Premium - Text Analytics SSL Spoofing (CVE-2012-5785)

Abstract Last updated on December 11, 2012. When using the Text Analytics Server from the IBM SPSS Modeler Premium product with the SSL option enabled default is disabled, then an SSL connection can be established without verifying the hostname of the target connection against the name on the SSL...

Security Bulletin: Apache Axis2 related vulnerability for IBM Tivoli Directory Integrator (CVE-2012-5785)

Abstract Apache Axis2 SSL vulnerability for IBM Tivoli Directory Integrator Content VULNERABILITY DETAILS: DESCRIPTION: Axis2 implemented in Java is vulnerable to man-in-the-middle attacks. By extension, all applications using this library to establish SSL connections with the target servers may ...

Security Bulletin: Multiple vulnerabilities in IBM Rational Policy Tester (CVE-2013-0531, CVE-2013-0440, CVE-2013-4062, CVE-2013-4061, CVE-2013-2407)

Abstract Previous releases of IBM Rational Policy Tester are affected by multiple vulnerabilities reported in 3rd party components bundled with the product as well as in proprietary IBM code. These vulnerabilities include Java components, weak cipher suites, invalid certificate warnings and URL...

Security Bulletin: GSKit SSL/TLS Record Length vulnerability in Tivoli Directory Server (CVE-2012-2191)

Abstract A vulnerability has been identified in the GSKit component utilized by Tivoli Directory Server TDS. A specifically crafted malformed SSL/TLS data packet can cause the TDS server using GSKit to segmentation fault.. Remediation for the issue consists of updating GSKit 7 to version 7.0.4.41...