PT-2022-14909

Name of the Vulnerable Software and Affected Versions Bachmann Visutec GmbH Atvise versions 3.5.4 through 3.7 Description An information disclosure issue exists in the License registration functionality. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perfo...

Design/Logic Flaw

A vulnerability in Cisco Unified IP Phones could allow an unauthenticated, remote attacker to impersonate another user's phone if the Cisco Unified Communications Manager CUCM is in secure mode. This vulnerability is due to improper key generation during the manufacturing process that could resul...

Bachmann Visutec GmbH Atvise License registration information disclosure vulnerability

Summary An information disclosure vulnerability exists in the License registration functionality of Bachmann Visutec GmbH Atvise 3.5.4, 3.6 and 3.7. A plaintext HTTP request can lead to a disclosure of login credentials. An attacker can perform a man-in-the-middle attack to trigger this...

CVE-2022-27221

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. An attacker in machine-in-the-middle could obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown strin...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

Code injection

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2022-29482

The CVE-2022-29482 entry concerns the Mobaoku-Auction & Flea Market iOS app, where improper server certificate verification (CWE-295) in versions prior to 5.5.16 enables a man-in-the-middle to eavesdrop on encrypted traffic. The vulnerability is mitigated by upgrading to version 5.5.16, released ...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2022-29482: Improper Certificate Validation

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

PT-2022-19647

Name of the Vulnerable Software and Affected Versions Mobaoku-Auction&Flea Market App for iOS versions prior to 5.5.16 Description The issue is related to improper server certificate verification, which may allow an attacker to eavesdrop on encrypted communication via a man-in-the-middle attack...

PT-2022-3475 · Schneider Electric · Ecostruxure Cybersecurity Admin Expert

Name of the Vulnerable Software and Affected Versions: EcoStruxure Cybersecurity Admin Expert CAE versions prior to 2.2 Description: The issue is related to improper certificate validation, which could allow a remote attacker to conduct man-in-the-middle attacks and disclose protected information...

FortiTokenMobile - Missing digital certificate validation

An improper validation of certificate with host mismatch vulnerability CWE-297 in FortiTokenMobile may allow an unauthenticated user to spoof the validation server identity and achieve a Man-in-the-Middle attack...

Lack of certificate verification when establishing secure connections

...

nodejs: Improper handling of URI Subject Alternative Names

A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host...

Chinese LuoYu Hackers Using Man-on-the-Side Attacks to Deploy WinDealer Backdoor

An "extremely sophisticated" Chinese-speaking advanced persistent threat APT actor dubbed LuoYu has been observed using a malicious Windows tool called WinDealer that's delivered by means of man-on-the-side attacks. "This groundbreaking development allows the actor to modify network traffic...

Man In The Middle (MitM)

libgfbgraph is vulnerable to man in the middle attack. The vulnerability exists due to a disabled TLS certificate verification on the SoupSessionSync objects allowing an attacker to bypass the certificate verification...

Debian DSA-5153-1 : trafficserver - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5153 advisory. Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in HTTP request smuggling or MITM...

OpenSSL RC4-MD5 Man-in-the-Middle

The vulnerability of the RC4-MD5 encryption algorithm in the OpenSSL library stems from the improper use of authenticated data as a MAC key. As a result, the MAC key becomes essentially predictable. Exploiting this vulnerability allows an attacker to execute a “man-in-the-middle” attack...

OpenSSL libpng Heap Buffer Overflow DoS

The vulnerability in the implementation of the OCSPbasicverify function in the OpenSSL library is related to errors in the certificate validation process when the OCSPNOCHECKS flag is used. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middle” attack...