CVE-2022-37709

CVE-2022-37709 affects Tesla Model 3 with firmware v11.0 (2022.4.5.1 6b701552d7a6) and Tesla mobile app v4.23. The issue is an authentication bypass by spoofing in the Phone Key flow, combined with Bluetooth Low Energy (BLE) channel weaknesses that enable a man-in-the-middle attack. Attackers wit...

PT-2022-24596 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM version 7.1.8 Description: The issue allows the browser to send plain text cookies over an insecure channel HTTP due to a Missing Secure Flag. An attacker may capture the cookie from the insecure channel using a Man-In-The-Middle MITM...

EulerOS 2.0 SP9 : curl (EulerOS-SA-2022-2310)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libcurl provides the CURLOPTCERTINFO option to allow applications torequest details to be returned about a server's certificate chain.Due to an...

Debian dla-3105 : connman - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3105 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3105-1 [email protected]...

CVE-2022-36173

FreshService macOS Agent 4.4.0 and FreshServce Linux Agent 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update service...

Design/Logic Flaw

FreshService macOS Agent 4.4.0 and FreshServce Linux Agent 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update service...

CVE-2022-36173

FreshService macOS Agent 4.4.0 and FreshServce Linux Agent 3.4.0 are vulnerable to TLS Man-in-The-Middle via the FreshAgent client and scheduled update service...

CVE-2022-36173

FreshService macOS Agent versions < 4.4.0 and FreshService Linux Agent versions

PT-2022-23243 · Freshservice · Freshservice Linux Agent +1

Name of the Vulnerable Software and Affected Versions: FreshService macOS Agent versions 4.4.0 FreshService Linux Agent versions 3.4.0 Description: The issue allows for TLS Man-in-The-Middle attacks via the FreshAgent client and scheduled update service. Recommendations: For FreshService macOS...

Freshworks FreshService 信任管理问题漏洞

Freshworks FreshService is a cloud-based IT help desk and service management solution from Freshworks, Inc. It enables organizations to streamline their IT operations. A security vulnerability exists in Freshworks FreshService macOS Agent versions prior to 4.4.0, FreshServce Linux Agent versions...

CVE-2022-26394

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

CVE-2022-26394

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

Authentication flaw

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

CVE-2022-26394 Unauthenticated network reconfiguration via TCP/UDP

The Baxter Spectrum WBM does not perform mutual authentication with the gateway server host. This may allow an attacker to perform a man in the middle attack that modifies parameters making the network connection fail...

CVE-2022-26394

CVE-2022-26394: Baxter Spectrum WBM/Sigma Spectrum devices fail mutual authentication with the gateway host, enabling a potential MITM and parameter manipulation that could disrupt network operation. Affected products include Sigma Spectrum v6.x/v8.x, Baxter Spectrum IQ v9.x, and Wireless Battery...

PT-2022-17826 · Baxter · Baxter Spectrum Wbm

Name of the Vulnerable Software and Affected Versions: Baxter Spectrum WBM affected versions not specified Description: The issue concerns a lack of mutual authentication with the gateway server host. This could allow an attacker to perform a man-in-the-middle attack, modifying parameters to caus...

CVE-2022-36076

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added and later checked a nonce was inadvertently rendered opt-i...

Code injection

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added and later checked a nonce was inadvertently rendered opt-i...

CVE-2022-36076 Account takeover via SSO plugins in NodeBB

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added and later checked a nonce was inadvertently rendered opt-i...

CVE-2022-36076 Account takeover via SSO plugins in NodeBB

NodeBB Forum Software is powered by Node.js and supports either Redis, MongoDB, or a PostgreSQL database. Due to an unnecessarily strict conditional in the code handling the first step of the SSO process, the pre-existing logic that added and later checked a nonce was inadvertently rendered opt-i...