Input validation

The Haier A6 Android device with a build fingerprint of Haier/A6/A6:8.1.0/O11019/1534219877:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.1.13. This app contains an exported service named...

Input validation

The Coolpad 1851 Android device with a build fingerprint of Coolpad/android/android:8.1.0/O11019/1534834761:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.1.13. This app contains an exported service name...

CVE-2019-15389

The CVE-2019-15389 entry concerns Haier A6 devices running Haier/A6/A6:8.1.0 with a pre-installed platform app com.lovelyfont.defcontainer (FontCoverService) that is exported and can be controlled by any co-located app to execute commands as the system user. A secondary app, com.ekesoo.lovelyhifo...

CVE-2019-15388

The Coolpad 1851 Android device with a build fingerprint of Coolpad/android/android:8.1.0/O11019/1534834761:userdebug/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer versionCode=7, versionName=7.1.13. This app contains an exported service name...

CVE-2019-15388

CVE-2019-15388 affects Coolpad 1851 devices with Android 8.1.0 where a pre-installed platform app com.lovelyfont.defcontainer exposes an exported service FontCoverService that accepts arbitrary commands and runs them as the system user. The attack requires no privileges and can be triggered by a ...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2010-4532

Removed by vendor...

CVE-2010-4532

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks...

CVE-2014-8167

vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack...

Design/Logic Flaw

vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack...

CVE-2014-8167

vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack...

CVE-2018-21029

A flaw in systemd-resolved was found to incorrectly verify certificates of a DNS resolver used for DNS Over TLS when the DNSOverTLS option is set to yes. A remote attacker in the network path between the vulnerable system and the DNS resolver may use this flaw to perform a man-in-the-middle attac...

October 8, 2019—KB4519985 (Security-only update)

None None...

October 8, 2019—KB4520007 (Monthly Rollup)

None None...

NetLogon Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Windows Netlogon improperly handles a secure communications channel. An attacker who successfully exploited the vulnerability could downgrade aspects of the connection allowing for further modification of the transmission. To exploit the...

Microsoft Windows Netlogon CVE-2019-1424 Security Bypass Vulnerability

Description Microsoft Windows Netlogon is prone to a security bypass vulnerability. Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks. Technologie...

McAfee Data Loss Prevention CVE-2019-3640 Information Disclosure Vulnerability

Description McAfee Data Loss Prevention is prone to an information-disclosure vulnerability. Attackers can exploit this issue to gain access to sensitive information by sniffing the traffic through a man-in-the-middle attack. Successful exploits will lead to other attacks. McAfee Data Loss...

CVE-2009-3552

In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface a Windows Presentation Foundation WPF XAML browser application to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the...