Authentication flaw

Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

CVE-2022-27619

CVE-2022-27619 affects Synology Note Station Client prior to 2.2.2-609. The issue is a cleartext transmission of sensitive information in authentication management, enabling man-in-the-middle attackers to obtain sensitive data via unspecified vectors. The connected PT Security entry confirms vers...

CVE-2022-27619

Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

CVE-2022-32293

In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes or code execution...

CVE-2022-27619: Cleartext Transmission of Sensitive Information

Cleartext transmission of sensitive information vulnerability in authentication management in Synology Note Station Client before 2.2.2-609 allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors...

PT-2022-18524 · Synology · Synology Note Station Client

Name of the Vulnerable Software and Affected Versions: Synology Note Station Client versions prior to 2.2.2-609 Description: The issue concerns a cleartext transmission of sensitive information vulnerability in authentication management. This allows man-in-the-middle attackers to obtain sensitive...

openSUSE 15 Security Update : connman (openSUSE-SU-2022:10076-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:10076-1 advisory. - In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer...

Input validation

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

CVE-2022-29154

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

CVE-2022-29154: Improper Input Validation

An issue was discovered in rsync before 3.2.5 that allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the rsync client performs insufficient validation of file names. A...

PT-2022-4620

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.2.5 Description An issue in rsync allows malicious remote servers to write arbitrary files inside the directories of connecting peers. The server chooses which files/directories are sent to the client. However, the...

OKHttp Square Authentication Bypass Man-in-the-Middle

The vulnerability of the client’s HTTP library, OKHttp Square, is related to errors in the certificate authentication process. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and execute a type of “man-in-the-middle” attack...

GO-2022-0370 Man-in-the-middle attack due to improper validation of certificate in mellium.im/xmpp

Websocket client connections are vulnerable to man-in-the-middle attacks via DNS spoofing. When looking up a WSS endpoint using a DNS TXT record, the server TLS certificate is incorrectly validated using the name of the server returned by the TXT record request, not the name of the the server bei...

Security Bulletin: IBM Robotic Process Automation is vulnerable to a man-in-the-middle due to ssh.net (CVE-2022-29245)

Summary ssh.net is used by IBM Robotic Process Automation as part of the secure communications. CVE-2022-29245. The fix includes ssh.net 2020.0.2.0 Vulnerability Details CVEID:CVE-2022-29245 DESCRIPTION: SSH.NET is vulnerable to a man-in-the-middle attack, caused by the use of a weak cryptographi...

Code injection

When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM Man in the Middle between a zero client and AWS session provisioner in the network. This issue is only...

GHSA-CM7J-P8HC-97VJ Jenkins Git client plugin 3.11.0 does not perform SSH host key verification

Jenkins Git client plugin 3.11.0 and earlier does not perform SSH host key verification when connecting to Git repositories via SSH, enabling man-in-the-middle attacks. Git client Plugin 3.11.1 provides strategies for performing host key verification for administrators to select the one that meet...

PT-2022-14126 · Teradici · Pcoip Zero Client

Name of the Vulnerable Software and Affected Versions: PCoIP Zero Client affected versions not specified Description: The issue arises when connecting to Amazon Workspaces, as the SHA256 presented by the AWS connection provisioner is not fully verified by Zero Clients. This could be exploited by ...