openSUSE Security Update : python-Twisted (openSUSE-2019-2068)

This update for python-Twisted fixes the following issues : Security issue fixed : - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks bsc1138461. This update was imported from the SUSE:SLE-15:Update update project. C Tenable Network Security, Inc. The...

OPENSUSE-SU-2019:2068-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: Security issue fixed: - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks bsc1138461. This update was imported from the SUSE:SLE-15:Update update project...

Security update for python-Twisted (moderate)

openSUSE Security Update: Security update for python-Twisted Announcement ID: openSUSE-SU-2019:2068-1 Rating: moderate References: 1138461 Cross-References: CVE-2019-12855 Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 An update that fixes one vulnerability is now available. Description...

SUSE SLED15 / SLES15 Security Update : python-Twisted (SUSE-SU-2019:2212-1)

This update for python-Twisted fixes the following issues : Security issue fixed : CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks bsc1138461. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security...

SUSE-SU-2019:2212-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: Security issue fixed: - CVE-2019-12855: Fixed TLS certificate verification to protecting against MITM attacks bsc1138461...

CVE-2019-1948

A vulnerability in Cisco Webex Meetings Mobile iOS could allow an unauthenticated, remote attacker to gain unauthorized read access to sensitive data by using an invalid Secure Sockets Layer SSL certificate. The vulnerability is due to insufficient SSL certificate validation by the affected...

Bluetooth vulnerability can be exploited in Key Negotiation of Bluetooth (KNOB) attacks

Those who are familiar with Bluetooth BR/EDR technology aka Bluetooth Classic, from 1.0 to 5.1 can attest that it is not perfect. Like any other piece of hardware or software technology already on market, its usefulness comes with flaws. Early last week, academics at Singapore University of...

GHSA-65RM-H285-5CC5 Improper Certificate Validation in Twisted

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections...

Black Hat 2019: 5G Security Flaw Allows MiTM, Targeted Attacks

LAS VEGAS — 5G commercial networks are starting to roll out, promising exciting new use cases like automated cars, and smart sensor networks where the nodes have 10-year battery lives. To go along with these possibilities are new security requirements; notably, improvements in device...

Exploit for Cleartext Transmission of Sensitive Information in Oneidentity Cloud_Access_Manager

CVE-2019-13498 Exploit Title: MITM - Missing HSTS causing cre...

Man-in-the-Middle (MitM)

http-request is vulnerable to man-in-the-middle MitM. The vulnerability exists due to the lack of SSL certification validation that allows certificate spoofing...

CVE-2019-5456

SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version = 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later...

Design/Logic Flaw

SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version = 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later...

CVE-2019-5456

CVE-2019-5456 concerns the UniFi Controller prior to version 5.10.22. An attacker can set up an SMTP proxy between the UniFi Controller (versions ≤ 5.10.21) and the real SMTP server to capture SMTP credentials, enabling a MITM-like credential theft via misrouted mail traffic. The connected docume...

CVE-2019-5456

SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version = 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later...

PT-2019-18667 · Elastic · Apm Agent For Ruby

Name of the Vulnerable Software and Affected Versions: Elastic APM agent for Ruby versions prior to 2.9.0 Description: A TLS certificate validation flaw was found in the Elastic APM agent for Ruby. When specifying a trusted server CA certificate via the server ca cert setting, the Ruby agent woul...

CVE-2019-13498

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security HSTS, which may allow man-in-the-middle MITM attacks. This issue is fixed in version 8.1.4...

Design/Logic Flaw

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security HSTS, which may allow man-in-the-middle MITM attacks. This issue is fixed in version 8.1.4...

CVE-2019-13498

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security HSTS, which may allow man-in-the-middle MITM attacks. This issue is fixed in version 8.1.4...

CVE-2019-13498

The CVE-2019-13498 issue affects One Identity Cloud Access Manager 8.1.3, where HTTP Strict Transport Security (HSTS) is not implemented. This absence can enable MITM-style attacks by downgrading protections, with the impact described as enabling/intercepting sensitive credential-related traffic....