PT-2024-29279

Name of the Vulnerable Software and Affected Versions Puncia versions prior to 0.21 Description The issue arises from API URLS utilizing HTTP instead of HTTPS for communication, leading to potential issues like Eavesdropping, Data Tampering, Unauthorized Data Access, and MITM Attacks...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Linux Linux_Kernel

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the...

CVE-2023-42010

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response using man in the middle techniques. IBM X-Force ID: 265507...

CVE-2023-42010 IBM Sterling B2B Integrator Standard Edition information disclosure

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response using man in the middle techniques. IBM X-Force ID: 265507...

CVE-2023-42010

IBM Sterling B2B Integrator Standard Edition is affected by CVE-2023-42010, with information disclosure in HTTP responses via potential man-in-the-middle techniques. Affected versions: 6.0.0.0–6.1.2.5 and 6.2.0.0–6.2.0.2. Reported impact is low (CVE/IBM X-Force CVSS ~LOW), and public exploit deta...

CVE-2024-20323

A vulnerability in Cisco Intelligent Node iNode Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Manager and associated intelligent nodes and send arbitrary traffic to an affected device. This vulnerability is due to the presence of...

foreman: Host ssh key not being checked in remote execution

A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can lead to a man-in-the-middle attack MITM, denial of...

CVE-2024-20323: Use of Hard-coded Cryptographic Key

A vulnerability in Cisco Intelligent Node iNode Software could allow an unauthenticated, remote attacker to hijack the TLS connection between Cisco iNode Manager and associated intelligent nodes and send arbitrary traffic to an affected device. This vulnerability is due to the presence of...

CVE-2023-42010: Exposure of Sensitive System Information to an Unauthorized Control Sphere

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.2 could disclose sensitive information in the HTTP response using man in the middle techniques. IBM X-Force ID: 265507...

PT-2024-5287 · Cisco · Cisco Intelligent Node

Name of the Vulnerable Software and Affected Versions: Cisco Intelligent Node iNode Software affected versions not specified Description: The issue is related to the use of a hard-coded cryptographic key in the software, which could allow a remote attacker to exploit the vulnerability and impact...

Security Bulletin: IBM Sterling B2B Integrator Standard Edition could disclose sensitive information in the HTTP response

Summary In IBM Sterling B2B Integrator's dashboard, many links have CSRF tokens at the end of URLs. An attacker could post something with a link to the B2Bi dashboard somewhere. If a B2Bi user who has the active http session and owns the token clicks the link then the request will be honored sinc...

CBL Mariner 2.0 Security Update: libgit2 / rust (CVE-2023-22742)

The version of libgit2 / rust installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-22742 advisory. - libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with t...

RADIUS Vulnerability

New attack against the RADIUS authentication protocol: The Blast-RADIUS attack allows a man-in-the-middle attacker between the RADIUS client and server to forge a valid protocol accept message in response to a failed authentication request. This forgery could give the attacker access to network...

CVE-2024-39886

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App...

CVE-2024-39886

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App...

CVE-2024-39886

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App...

CVE-2024-39886

The TONE store App (provided by DREAM TRAIN INTERNET INC.) versions 3.4.2 and earlier is vulnerable to a cleartext transmission issue (CWE-419 ) when communicating with the TONE store website. This unprotected primary channel allows a man-in-the-middle (MITM) attack, where an adversary could inte...

Fortinet FortiWeb ] Lack of client-side certificate validation when establishing secure connections (FG-IR-22-326)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-326 advisory. - An improper certificate validation vulnerability CWE-295 in FortiWeb 7.2.0 through 7.2.1, 7.0 all versions, 6.4 all versions...

CVE-2024-39886: Unprotected Primary Channel

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App...

PT-2024-28710 · Unknown · Tone Store App

Name of the Vulnerable Software and Affected Versions: TONE store App versions 3.4.2 and earlier Description: The issue is related to an unprotected primary channel in the TONE store App, which communicates with the TONE store website in cleartext. This could allow a man-in-the-middle attack,...