CVE-2024-39350: Authentication Bypass by Spoofing

A vulnerability regarding authentication bypass by spoofing is found in the RTSP functionality. This allows man-in-the-middle attackers to obtain privileges without consent via unspecified vectors. The following models with Synology Camera Firmware versions before 1.0.7-0298 may be affected: BC50...

CVE-2024-39347: Incorrect Default Permissions

Incorrect default permissions vulnerability in firewall functionality in Synology Router Manager SRM before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to access highly sensitive intranet resources via unspecified vectors...

CVE-2024-39348: Download of Code Without Integrity Check

Download of code without integrity check vulnerability in AirPrint functionality in Synology Router Manager SRM before 1.2.5-8227-11 and 1.3.1-9346-8 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors...

CVE-2024-36755

D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change the downloading URL via a man-in-the-middle attack...

CVE-2024-36755: Missing Validation of OpenSSL Certificate

D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change the downloading URL via a man-in-the-middle attack...

CVE-2024-36755

D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change the downloading URL via a man-in-the-middle attack...

CVE-2024-29175

CVE-2024-29175 concerns Dell PowerProtect Data Domain. The affected products are Dell PowerProtect Data Domain versions prior to 7.13.0.0, LTS 7.7.5.40, and LTS 7.10.1.30, where a weak cryptographic algorithm vulnerability could enable a remote, unauthenticated attacker to perform a man-in-the-mi...

CVE-2024-29175

Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session...

CVE-2024-29175

Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session...

Brocade SANnav Man-in-the-Middle SSH Decrypt

The vulnerability of the Brocade SANnav network management software is related to the use of strictly encrypted authentication credentials. Exploiting this vulnerability allows a remote attacker to perform a Man-in-the-Middle MITM attack and decrypt SSH traffic...

Dell PowerProtect Data Domain Weak Encryption Algorithm Vulnerability

Dell PowerProtect Data Domain is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell USA. A weak cryptographic algorithm vulnerability exists in Dell PowerProtect Data Domain, which could be exploited by an attacker to cause a man-in-the-middle attack,...

CVE-2024-29175: Use of a Broken or Risky Cryptographic Algorithm

Dell PowerProtect Data Domain, versions prior to 7.13.0.0, LTS 7.7.5.40, LTS 7.10.1.30 contain an weak cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to man-in-the-middle attack that exposes sensitive session...

PT-2024-6389 · Libnbd +7 · Libnbd +7

Name of the Vulnerable Software and Affected Versions: libnbd affected versions not specified Description: The issue is related to a flaw in the libnbd library, where the client does not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This allows a...

Security Bulletin: IBM Analytics Content Hub is affected by security vulnerabilities

Summary Security Bulletin: IBM Analytics Content Hub is affected, but not classified as vulnerable, based on current information, to vulnerabilities in Open Source Software. IBM Analytics Content Hub has addressed the applicable CVEs by upgrading the vulnerable libraries. Vulnerability Details...

CLSA-2024-1718895586 systemd: Fix of CVE-2023-7008

CVE-2023-7008: prevent systemd-resolved from accepting DNS records of DNSSEC- signed domains without a signature to mitigate man-in-the-middle attacks...

PT-2024-32030 · Tp Link · Kasa Kp125M +1

Name of the Vulnerable Software and Affected Versions: TP-Link Tapo P125M and Kasa KP125M version 1.0.3 Description: The issue allows attackers to eavesdrop on communications and access sensitive information via a man-in-the-middle attack due to improper validation of certificates. Recommendation...

FileCatalyst Direct Security Vulnerability

FileCatalyst Direct is a pure software solution that uses a server-client architecture to manage and accelerate file transfers. A security vulnerability exists in FileCatalyst Direct 3.8.10 Build 138 and earlier and FileCatalyst Workflow 5.1.6 Build 130 and earlier, which stems from the presence ...

Security Bulletin: IBM DevOps Release addresses multiple vulnerabilities.

Summary IBM DevOps Release 7.0.0.2 addresses multiple vulnerabilities. Vulnerability Details CVEID:CVE-2014-3643 DESCRIPTION: Jersey could allow a remote attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data by jersey SAX parser. By sending ...

CVE-2024-36289

Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a man-in-the-middle attack...

CVE-2024-36279

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages DMs between users may be manipulated by a...