CVE-2022-28861

Citilog 8.0 is affected. The vulnerability arises in the server component that communicates with the Axis M1125 camera, enabling a man-in-the-middle adversary to observe FTP credentials in cleartext HTTP traffic between the server and the camera. Impact is credential exposure enabling FTP access ...

CVE-2022-28860

The CVE-2022-28860 entry describes an authentication downgrade in the Citilog 8.0 server when communicating with the Axis M1125 smart camera, allowing an attacker in a man‑in‑the‑middle position to gain HTTP access to the camera. Affected component: Citilog 8.0 server; vulnerable path involves th...

CVE-2022-28860

An authentication downgrade in the server in Citilog 8.0 allows an attacker in a man in the middle position between the server and its smart camera Axis M1125 to achieve HTTP access to the camera...

CVE-2022-20860: Improper Certificate Validation

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus...

CVE-2022-28860: Undefined Security Weakness

An authentication downgrade in the server in Citilog 8.0 allows an attacker in a man in the middle position between the server and its smart camera Axis M1125 to achieve HTTP access to the camera...

CVE-2022-28861: Cleartext Transmission of Sensitive Information

The server in Citilog 8.0 allows an attacker in a man in the middle position between the server and its smart camera Axis M1125 to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server...

PT-2022-19268 · Axis · Axis M1125

Name of the Vulnerable Software and Affected Versions: Citilog version 8.0 Description: The server in Citilog allows an attacker, in a man-in-the-middle position between the server and its smart camera Axis M1125, to see FTP credentials in cleartext HTTP traffic. These credentials can be used for...

PT-2022-19267 · Axis · Axis M1125

Name of the Vulnerable Software and Affected Versions: Citilog version 8.0 Description: An authentication downgrade in the server allows an attacker, in a man-in-the-middle position between the server and its smart camera Axis M1125, to achieve HTTP access to the camera. Recommendations: For...

CVE-2022-20860

A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or view sensitive information. This vulnerability exists because SSL server certificates are not validated when Cisco Nexus...

PT-2022-3925

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard affected versions not specified Description A vulnerability in the SSL/TLS implementation of Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to alter communications with associated controllers or vie...

CVE-2021-22131

A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks...

CVE-2021-22131

A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks...

CVE-2021-22131

A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks...

CVE-2021-22131: Improper Certificate Validation

A improper validation of certificate with host mismatch in Fortinet FortiTokenAndroid version 5.0.3 and below, Fortinet FortiTokeniOS version 5.2.0 and below, Fortinet FortiTokenWinApp version 4.0.3 and below allows attacker to retrieve information disclosed via man-in-the-middle attacks...

PT-2022-9230

Name of the Vulnerable Software and Affected Versions Fortinet FortiTokenAndroid versions 5.0.3 and below Fortinet FortiTokeniOS versions 5.2.0 and below Fortinet FortiTokenWinApp versions 4.0.3 and below Description The issue is related to improper validation of certificates with host mismatch,...

Softing Secure Integration Server security vulnerability

Softing Secure Integration Server is a secure integration server from Softing Germany. It provides a powerful OPC UA data integration layer and supports interface abstraction, aggregation, data preprocessing and security supervision. A security vulnerability exists in Softing Secure Integration...

SUSE SLES12 Security Update : curl (SUSE-SU-2022:2356-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2022:2356-1 advisory. - When curl 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a...

Schneider Electric EcoStruxure Cybersecurity Admin Expert Certificate Authenticity Man-in-the-Middle

The vulnerability of Schneider Electric’s Security Management Software, EcoStruxure Cybersecurity Admin Expert CAE, is related to errors in verifying the authenticity of certificates. Exploiting this vulnerability can allow attackers to carry out “man-in-the-middle” attacks and expose the protect...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors

Summary There are multiple vulnerabilities in OpenSSL which is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors Vulnerability Details CVEID:CVE-2022-0778 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a flaw in the BNmodsqrt function when parsi...

SUSE SLES12 Security Update : curl (SUSE-SU-2022:2288-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2288-1 advisory. - curl 7.84.0 supports chained HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and...