PT-2024-10726

Name of the Vulnerable Software and Affected Versions nvOC versions 3.2 and earlier Description The issue allows man-in-the-middle attacks due to SSH host keys being baked into the installation image. This also makes it trivial to identify all public IPv4 nodes using Shodan.io. The vendor has...

CVE-2020-5200

Minerbabe versions through V4.16 are vulnerable because SSH host keys are baked into the installation image. This flaw enables man-in-the-middle attacks and allows for the trivial identification of all public IPv4 nodes using Shodan.io . To mitigate this risk, it is recommended to regenerate SSH ...

SimpleMiningOS security vulnerabilities

SimpleMiningOS is a mining operating system open-sourced by SimpleMining Poland. A security vulnerability exists in SimpleMiningOS version v1259, which stems from the inclusion of SSH host keys in the installation image, allowing man-in-the-middle attacks and enabling Shodan.io to easily identify...

CVE-2019-19753

SimpleMiningOS versions through v1259 are affected by a vulnerability where SSH host keys are baked into the installation image. This oversight enables man-in-the-middle (MITM) attacks and allows for the trivial identification of all public IPv4 nodes using Shodan.io . The vendor has stated they ...

CVE-2019-19753

SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they have no plans to fix this, and discourage deployment using...

CVE-2019-19752

nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build...

CVE-2020-5200

Minerbabe through V4.16 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...

CVE-2019-19753: Use of Hard-coded Cryptographic Key

SimpleMiningOS through v1259 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: the vendor indicated that they have no plans to fix this, and discourage deployment using...

CVE-2019-19755: Authorization Bypass Through User-Controlled Key

ethOS through 1.3.3 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated that they plan to fix this...

CVE-2019-19751: Channel Accessible by Non-Endpoint

easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...

CVE-2019-19751

easyMINE before 2019-12-05 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io...

CVE-2019-19754

HiveOS versions 0.6-102@191212 and earlier are vulnerable because SSH host keys are baked into the installation image. This hard-coded configuration enables man-in-the-middle attacks and allows for the trivial identification of all public IPv4 nodes using Shodan.io . To mitigate this risk, users ...

CVE-2019-19754: Use of Hard-coded Cryptographic Key

HiveOS through 0.6-102@191212 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-09-26, the vendor indicated that they would consider fixing this...

shim: RCE in http boot support may lead to Secure Boot bypass

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete...

RHEL 8 : OpenShift Container Platform 4.8.56 (RHSA-2023:0017)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0017 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

RHEL 7 : qpid-proton (RHSA-2019:1399)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1399 advisory. The AMQ Client enables connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol. This update provides various bug fixes...

RHEL 7 : qpid-proton (RHSA-2019:1400)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1400 advisory. The AMQ Client enables connecting, sending, and receiving messages over the AMQP 1.0 wire transport protocol. Security Fixes: qpid-proton: TLS Man in...

[SECURITY] [DLA 3794-1] putty security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3794-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès April 25, 2024 https://wiki.debian.org/LTS -...

Debian dla-3794 : pterm - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3794 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3794-1 [email protected]...

Vulnerability fixed in MongoDB Compass

MongoDB developers have fixed a vulnerability in MongoDB Compass. A malicious party could exploit the vulnerability to use a Man-in-the-Middle attack to gain access to sensitive data, or impersonate another user. MongoDB has released updates to fix the vulnerability in Compass 1.42.1. For more...