Security Bulletin: SMB vulnerabilities in IBM N Series Products

Summary Data ONTAP products implement the SMB protocol. Systems that implement the SMB protocol can be susceptible to one or more man-in-the-middle attacks which when exploited could potentially lead to information disclosure, privilege escalation, or a Denial of Service. Vulnerability Details...

Security Bulletin: CVE-2015-4000 Diffie-Hellman Export Cipher Suite Vulnerabilities in Multiple N series Products

Summary A vulnerability known as Logjam may affect multiple N series products and the impact is under investigation. Versions 1.2 and earlier of the Transport Layer Security TLS protocol can allow man-in-the-middle MITM attackers to conduct downgrade attacks. Multiple N series Products has...

CVE-2021-29847

CVE-2021-29847 affects IBM Power System BMC/firmware on POWER8 OP825 family (S821LC 8001-12C, OP825.50). The issue arises from a configuration change that allows an authenticated user to open an insecure communication channel, enabling an attacker to obtain sensitive information via a man-in-the-...

CVE-2021-29847

BMC firmware IBM Power System S821LC Server 8001-12C OP825.50 configuration changed to allow an authenticated user to open an insecure communication channel which could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 205267...

Man In The Middle (MitM)

org.apache.sling:org.apache.sling.commons.messaging.mail is vulnerable to man-in-the-middle MitM attacks. Lack of server identity checks when accessing mail servers allow remote attackers to perform man in the middle attacks when participating in a shared mail session...

SUSE SLED15: postgresql10 / postgresql10-contrib / postgresql10-devel / etc (SUSE-SU-2021:4058-1)

The remote SUSE Linux SLED15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:4058-1 advisory. - CVE-2021-23214: Make the server reject extraneous data after an SSL or GSS encryption handshake bsc1192516. -...

PT-2021-18517

Name of the Vulnerable Software and Affected Versions BMC firmware IBM Power System S821LC Server 8001-12C version OP825.50 Description The BMC firmware configuration allows an authenticated user to open an insecure communication channel, potentially enabling an attacker to obtain sensitive...

CVE-2021-29847: Undefined Security Weakness

BMC firmware IBM Power System S821LC Server 8001-12C OP825.50 configuration changed to allow an authenticated user to open an insecure communication channel which could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 205267...

CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-41067

An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation o...

CVE-2021-41067

An issue was discovered in Listary through 6. Improper implementation of the update process leads to the download of software updates with a /check-update HTTP-based connection. This can be exploited with MITM techniques. Together with the lack of package validation, it can lead to manipulation o...

CVE-2021-44549 SMTPS server hostname not checked when making TLS connection to SMTPS server

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-44549

CVE-2021-44549 affects Apache Sling Commons Messaging Mail (Sling Mail) implementations that use SMTPS. The issue arises from the SimpleMailService in Apache Sling Commons Messaging Mail 1.0 which lacked an option to enable mail.smtps.ssl.checkserveridentity by default, leaving SMTPS connections ...

CVE-2021-44549

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

CVE-2021-42027

A vulnerability has been identified in SINUMERIK Edge All versions V3.2. The affected software does not properly validate the server certificate when initiating a TLS connection. This could allow an attacker to spoof a trusted entity by interfering in the communication path between the client and...

Pluck Access Control Error Vulnerability

Pluck is a content management system CMS developed using the PHP language. an access control error vulnerability exists in Pluck-CMS Pluck, which stems from a missing SSL certificate validation issue in updateapplet.php, which could lead to a man-in-the-middle attack. No details of the...

CVE-2021-44549: Improper Certificate Validation

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these addition...

PT-2021-23064

Name of the Vulnerable Software and Affected Versions Listary versions prior to 7 Description An issue exists due to the improper implementation of the update process, which uses a /check-update HTTP-based connection to download software updates. This can be exploited using Man-In-The-Middle MITM...

Apache Sling Commons Messaging Mail Trust Management Vulnerability

Apache Sling Commons Messaging Mail is an open source messaging mail service from the Apache Foundation in the U.S. A trust management issue vulnerability exists in Apache Sling Commons Messaging Mail 1.0.0, which stems from the Apache Sling Commons Messaging Mail provides a simple layer on top o...

IBM Power System security vulnerabilities

IBM Power System is a Power processor-based server computer from IBM U.S.A. The Power System firmware has a security vulnerability that could be exploited by an attacker to gain access to sensitive information using man-in-the-middle techniques...