CVE-2020-6781

Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept video contents by performing a man-in-the-middle attack...

Man-in-the-Middle (MitM)

swinglibrary is vulnerable to man-in-the-middle attacks. An insecure HTTP channel is used to download a third-party library during build, allowing a man-in-the-middle attacker to intercept and modify the contents of the library...

CVE-2020-12619

MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the...

CVE-2020-12618

eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enable...

Code injection

eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enable...

Code injection

MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the...

CVE-2020-12618

eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enable...

CVE-2020-12618

CVE-2020-12618 affects eM Client prior to 7.2.33412.0 where S/MIME certificates are automatically imported, silently replacing existing ones. This enables a remote attacker to perform a man‑in‑the‑middle attack by obtaining an email‑validated S/MIME certificate from a trusted CA and substituting ...

CVE-2020-12619

MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the...

in imsobear/node-browser

Overview node-browser is a wrapper webdriver by Node.js, this package is vulnerable to Man in the Middle MitM attacks due to downloading resources over an insecure protocol. Without a secure connection, it is possible for an attacker to intercept this connection and alter the packages received. I...

QiHang Media Web Digital Signage 3.0.9 Password Disclosure Vulnerability

QiHang Media Web Digital Signage version 3.0.9 suffers from a cleartext transmission/storage of sensitive information in a cookie. This allows a remote attacker to intercept the HTTP Cookie authentication credentials via a man-in-the-middle attack. QiHang Media Web QH.aspx Digital Signage 3.0.9...

Man-in-the-Middle (MitM)

jangaroo-parent is vulnerable to man-in-the-middle MitM. The vulnerability exists as its dependencies are resolved over HTTP instead of HTTPS...

QiHang Media Web (QH.aspx) Digital Signage 3.0.9 Cookie User Password Disclosure

Summary Digital Signage Software. Description The application suffers from a cleartext transmission/storage of sensitive information in a cookie. This allows a remote attacker to intercept the HTTP Cookie authentication credentials via a man-in-the-middle attack. QiHang Media Web QH.aspx Digital...

CS2 Network P2P Trust Management Issue Vulnerability

CS2 Network P2P is a P2P peer-to-peer networking platform. A security vulnerability exists in CS2 Network P2P 3.x and earlier versions. This vulnerability can be exploited by an attacker to conduct a man-in-the-middle attack...

CVE-2020-9525

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attackers to perform a man-in-the-middle attack, as demonstrated by eavesdropping on user video/audio streams, capturing credentials, and compromising devices...

Authentication flaw

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attackers to perform a man-in-the-middle attack, as demonstrated by eavesdropping on user video/audio streams, capturing credentials, and compromising devices...

CVE-2020-9525

CS2 Network P2P through 3.x, as used in millions of Internet of Things devices, suffers from an authentication flaw that allows remote attackers to perform a man-in-the-middle attack, as demonstrated by eavesdropping on user video/audio streams, capturing credentials, and compromising devices...

CVE-2020-9525

CVE-2020-9525 affects CS2 Network P2P up through version 3.x used in IoT devices. The connected documents describe an authentication flaw that enables a man-in-the-middle attack, allowing eavesdropping on video/audio streams, credential capture, and device compromise. The root cause is an authent...

TLS Version 1.1 Protocol Detection (PCI DSS)

The remote service accepts connections encrypted using TLS 1.1. This version of TLS is affected by multiple cryptographic flaws. An attacker can exploit these flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected service and clients. C Tenable Network...

Bypassing MassLogger Anti-Analysis — a Man-in-the-Middle Approach

The FireEye Front Line Applied Research & Expertise FLARE Team attempts to always stay on top of the most current and emerging threats. As a member of the FLARE Reverse Engineer team, I recently received a request to analyze a fairly new credential stealer identified as MassLogger. Despite the la...