Oracle Linux 8 : libpq (ELSA-2020-5401)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5401 advisory. 12.5-1 - Rebase to upstream release 12.5 Resolves: rhbz1898228 Resolves: rhbz1901558 Tenable has extracted the preceding description block directly fro...

CVE-2020-14368

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery CSRF and consequently allowing a cross-site WebSocket hijack on Thei...

CVE-2020-14368

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery CSRF and consequently allowing a cross-site WebSocket hijack on Thei...

CVE-2020-14368

A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, Theia IDE doesn't properly set the SameSite value, allowing a Cross-Site Request Forgery CSRF and consequently allowing a cross-site WebSocket hijack on Thei...

postgresql: Reconnection can downgrade connection security settings

A flaw was found in postgresql. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could...

EulerOS 2.0 SP8 : postgresql (EulerOS-SA-2020-2526)

According to the versions of the postgresql packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client...

Security Bulletin: App Connect Enterprise Certified Container may be vulnerable to man in the middle attack through use of OpenSSL (CVE-2019-1551)

Summary App Connect Enterprise Certified Container may be vulnerable to man in the middle attack through use of OpenSSL via CVE-2019-1551 Vulnerability Details CVEID: CVE-2019-1551 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information, caused by an overflow in the x64...

Man-in-the-Middle (MitM)

opencast-kernel is vulnerable to man-in-the-middle attack. The hostname verification is disabled by default, allowing for man-in-the-middle attackers to intercept and modify network traffic...

Opencast < 7.9, 8.0 < 8.9 Hostname Verification Vulnerability

Opencast is prone to a hostname verification vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of Apache Log4j. Vulnerability Details CVEID: CVE-2020-9488 DESCRIPTION: Apache Log4j is vulnerable to a man-in-the-middle attack, caused by improper certificate validation with host mismatch in the SMTP appende...

CVE-2020-26234

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

Code injection

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

Disabled Hostname Verification in Opencast

Opencast before version 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

CVE-2020-26234 Disabled Hostname Verification in OpenCast

Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...

CVE-2020-26234

Opencast versions before 8.9 and 7.9 disable HTTPS hostname verification in its HTTP client, enabling potential MITM attacks. Root cause: hostname verification was disabled for a large portion of HTTP requests. Affected component/file: Opencast HTTP client. Impact: confidentiality/integrity conce...

PT-2020-20205

Name of the Vulnerable Software and Affected Versions Kubernetes API server versions prior to a fixed version the fixed version is not specified Description The issue allows an attacker who can create a ClusterIP service and set the spec.externalIPs field to intercept traffic to that IP address...

Kubernetes Security Vulnerabilities

Kubernetes is an open source Docker container cluster management system from the Linux Foundation. The system provides resource scheduling, deployment and operation, service discovery, and scaling up and down for containerized applications. Kubernetes suffers from a security vulnerability that ca...

Insecure SSL Validation

elinks does not securely validate SSL certificates. Missing SSL Certificate Validation allows for potential man-in-the-middle attacks...

Man-In-The-Middle

serf is vulnerable to man-in-the-middle MitM attacks. The vulnerability existed because of an improper handling of a NUL byte in a domain name in the subject's Common Name CN, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

Man-in-the-Middle (MitM)

mutt is vulnerable to man-in-the-middle MitM. The vulnerability exists as the connection would not properly close, and would keep retrying, when the $sslforcetls was processed if an IMAP server's initial server response was invalid...