21860 matches found
CVE-2020-23036
MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the password authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to re...
The vulnerability of the Java Eclipse Che development environment server, related to the lack of message integrity checking, allows attackers to carry out “man-in-the-middle” attacks.
The vulnerability of the Java Eclipse Che development environment server is related to the lack of integrity checks for messages. Exploiting this vulnerability allows a remote attacker to perform “man-in-the-middle” attacks...
CVE-2021-35228
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remo...
CVE-2021-35228
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remo...
CVE-2021-35228 Reflected cross site scripting affecting SolarWinds: DPA 2021.3.7388
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remo...
CVE-2021-31386
A Protection Mechanism Failure vulnerability in the J-Web HTTP service of Juniper Networks Junos OS allows a remote unauthenticated attacker to perform Person-in-the-Middle PitM attacks against the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S20; 15.1...
CVE-2021-0296
The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security HSTS. HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade...
Design/Logic Flaw
The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security HSTS. HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade...
Downgrade Attack
thunderbird is vulnerable to downgrade attack. Remote attacker is able to take control of the authenticated session and execute SMTP commands resulting in a man in the middle attack...
Vulnerability fixed in Palo Alto Networks GlobalProtect
A vulnerability has been fixed in Palo Alto Networks GlobalProtect app. A malicious party could potentially exploit it to perform a man-in-the-middle attack or to execute execute arbitrary code under SYSTEM privileges. Palo Alto Networks has released updates to fix the vulnerability fix in...
CVE-2021-3057
A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProtect app 5.1 versions earlier than...
Stack overflow
A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProtect app 5.1 versions earlier than...
CVE-2021-3057 GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway
A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. This issue impacts: GlobalProtect app 5.1 versions earlier than...
CVE-2021-3057
CVE-2021-3057 is a stack-based buffer overflow in Palo Alto Networks GlobalProtect app affecting specific release branches: Windows 5.1.x before 5.1.9, Windows 5.2.x before 5.2.8, UWP 5.2.x before 5.2.8, and Linux 5.3.x before 5.3.1. The root cause is a stack-based memory overflow that can be tri...
GlobalProtect App: Buffer Overflow Vulnerability When Connecting to Portal or Gateway
A stack-based buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect app that enables a man-in-the-middle attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privileges. Work around: There are no known workarounds for this issue...
Mozilla: Downgrade attack on SMTP STARTTLS connections
Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...
CVE-2021-20833
The CVE-2021-20833 advisory concerns the SNKRDUNK Market Place App for iOS prior to version 2.2.0, which has improper server certificate verification. The underlying issue is certificate validation failure in the app, enabling a man-in-the-middle (MitM) attacker to eavesdrop on and potentially al...
SUSE SLES12 Security Update : curl (SUSE-SU-2021:3351-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3351-1 advisory. - CVE-2021-22947: Fixed STARTTLS protocol injection via MITM bsc1190374. - CVE-2021-22946: Fixed protocol downgrade required TLS...
Debian DLA-2780-1 : ruby2.3 - LTS security update
The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2780 advisory. Multiple vulnerabilites in ruby2.3, interpreter of object-oriented scripting language Ruby, were discovered. CVE-2021-31799 In RDoc 3.11 through 6.x before 6.3.1, ...
