Security Advisory 2020-01-31-1 - Opkg susceptible to MITM (CVE-2020-7982)

DESCRIPTION A bug in the package list parse logic of OpenWrt's opkg fork caused the package manager to ignore SHA-256 checksums embedded in the signed repository index, effectively bypassing integrity checking of downloaded .ipk artifacts. The bug has been introduced with commit...

CVE-2019-11288

CVE-2019-11288 affects Pivotal tc Server and Pivotal tc Runtime components. The issue occurs when a tc Runtime has the JMX Socket Listener enabled, allowing a local attacker to manipulate the RMI registry and perform a man-in-the-middle attack to capture usernames and passwords used to access the...

CVE-2017-14806

A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Studio onsite susestudio-common version...

Input validation

A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Studio onsite susestudio-common version...

CVE-2017-14806

CVE-2017-14806 concerns an Improper Certificate Validation in SUSE Studio onsite’s susestudio-common, affecting version 1.3.17-56.6.3 and earlier. The vulnerability could allow remote attackers to perform MITM on repository connections, enabling modification of delivered packages. Connected docum...

CVE-2017-14806 Insecure handling of repodata and packages in SUSE Studio onlite

A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Studio onsite susestudio-common version...

UBUNTU-CVE-2019-15795

python-apt only checks the MD5 sums of downloaded files in Version.fetchbinary and Version.fetchsource of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions...

CVE-2019-10214

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launc...

PoC Exploits Published For Microsoft Crypto Bug

Two proof-of-concept PoC exploits have been publicly released for the recently-patched crypto-spoofing vulnerability found by the National Security Agency and reported to Microsoft. The vulnerability CVE-2020-0601 could enable an attacker to spoof a code-signing certificate necessary for validati...

CVE-2012-1316

Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks...

CVE-2012-1326

Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks...

Design/Logic Flaw

Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks...

Code injection

Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks...

CVE-2012-1326

Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks...

CVE-2012-1326

CVE-2012-1326 affects Cisco IronPort Web Security Appliance (WSA) up to and including version 7.5, where the software does not properly validate the basic constraints of the certificate authority in SSL/TLS. This misconfiguration could allow an unauthenticated, remote attacker to perform man‑in‑t...

CVE-2012-1326

Cisco IronPort Web Security Appliance up to and including 7.5 does not validate the basic constraints of the certificate authority which could lead to MITM attacks...

CVE-2012-1316

Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks...

CVE-2012-1316

Cisco IronPort Web Security Appliance does not check for certificate revocation which could lead to MITM attacks...

CVE-2012-1316

CVE-2012-1316 affects the Cisco IronPort Web Security Appliance, where the product does not check for certificate revocation, potentially enabling MITM attacks. The linked sources show an impact on integrity (CVSS3.1: HIGH) with network exposure (CVSS3.1: AV:N, AC:H, PR:N, UI:N, S:U) and a CVSSv2...

CVE-2019-20057

com.proxyman.NSProxy.HelperTool in Privileged Helper Tool in Proxyman for macOS 1.11.0 and earlier allows an attacker to change the System Proxy and redirect all traffic to an attacker-controlled computer, enabling MITM attacks...