CVE-2019-11650

CVE-2019-11650 concerns NetIQ Advanced Authentication Framework. The affected product is NetIQ Advanced Authentication Framework, with MITM vulnerability reported in versions prior to 6.0. The root cause and specifics beyond the affected version range aren’t detailed in the provided documents. Th...

CVE-2019-5982

Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a malicous wireless LAN access point. A successful exploitation may result in a malicious file being downloaded/executed...

Information disclosure

The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Input validation

Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a malicous wireless LAN access point. A successful exploitation may result in a malicious file being downloaded/executed...

CVE-2019-5982

Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a malicous wireless LAN access point. A successful exploitation may result in a malicious file being downloaded/executed...

CVE-2019-5982

CVE-2019-5982 affects Sony VAIO Update (versions 7.3.0.03150 and earlier). The issue is improper verification of downloaded files (CWE-669), allowing a man-in-the-middle attack over a malicious wireless LAN access point to cause a malicious file to be downloaded and executed. Red Hat/Redundant re...

CVE-2019-5961

The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

UBUNTU-CVE-2019-10103

JetBrains IntelliJ IDEA projects created using the Kotlin JS Client/JVM Server IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This issue, which was fixed in Kotlin plugin version 1.3.30, is similar to CVE-2019-10101...

Binding CVE-2019-1040 vulnerability of the two domains provide the right depth of analysis-vulnerability warning-the black bar safety net

2019, 6 month, Microsoft released a security update. The update for CVE-2019-1040 vulnerability to repair. This vulnerability, an attacker could man in the middle attacks, bypassing the NTLM MIC（message integrity check protection, the authentication traffic is relayed to the target server. Throug...

Man-in-the-Middle (MitM)

django is vulnerable to man-in-the-middle attacks. HTTP requests are not redirected to HTTPS in accordance with SECURESSLREDIRECT when deployed behind a reverse-proxy due to incorrect results for issecure and buildabsoluteuri...

F5 Networks BIG-IP : SNMP vulnerability (K40443301)

SNMP exposes sensitive configuration objects over insecure transmission channels. This issue is exposed when a passphrase is inserted into various profile types and accessed using SNMPv2. CVE-2019-6640 Impact An attacker with direct SNMP access to a BIG-IP system, or an attacker with a privileged...

FaceSentry Access Control System 6.4.8 Authentication Credential Disclosure

FaceSentry Access Control System 6.4.8 Authentication Credentials MiTM Disclosure Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorithm A14 Summary: FaceSentry 5AN...

GHSA-38CG-GG9J-Q9J9 Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself CDP or through the separately configured path. The CRL are often availab...

Google Announces DNS over HTTPS 'General Availability'

Google announced general availability of its Public DNS-over-HTTPS service Wednesday, based on the Internet Engineering Task Force’s RFC 8484 standard. The move is a culmination of three years of Google fine-tuning DNS over HTTPS, otherwise known as DoH. “Today we are announcing general...

CVE-2019-4150

IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. IBM X-Force ID: 158510...

Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Access Manager Appliance

Summary Multiple Security vulnerabilities have been fixed in the 9.0.7 IBM Security Access Manager ISAM appliance. Vulnerability Details CVEID: CVE-2018-0732 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the sending of a very large prime value to the client by a malicious...

JVN#13555032: Multiple vulnerabilities in VAIO Update

VAIO Update provided by Sony Corporation contains multiple vulnerabilities listed below. Improper authorization process CWE-285 - CVE-2019-5981 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H| Base Score: 7.8 CVSS v2| AV:N/AC:M/Au:N/C:P/I:P/A:P| Base Score...

CVE-2019-10997

An issue was discovered on Phoenix Contact AXC F 2152 No.2404267 before 2019.0 LTS and AXC F 2152 STARTERKIT No.1046568 before 2019.0 LTS devices. Protocol Fuzzing on PC WORX Engineer by a man in the middle attacker stops the PLC service. The device must be rebooted, or the PLC service must be...

Code injection

An issue was discovered on Phoenix Contact AXC F 2152 No.2404267 before 2019.0 LTS and AXC F 2152 STARTERKIT No.1046568 before 2019.0 LTS devices. Protocol Fuzzing on PC WORX Engineer by a man in the middle attacker stops the PLC service. The device must be rebooted, or the PLC service must be...

CVE-2019-10997

CVE-2019-10997 affects Phoenix Contact PLCNext AXC F 2152 family (article 2404267) and Starterkit (1046568) prior to firmware 2019.0 LTS. The issue arises from a man-in-the-middle scenario where protocol fuzzing on PC WORX Engineer can cause the PLC service to stop, requiring a reboot or manual r...