CVE-2017-10668

The CVE-2017-10668 issue is a Padding Oracle vulnerability in OSCI-Transport 1.2 as used by OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET). Under MITM conditions in the OSCI infrastructure, an attacker can send crafted protocol messages to analyze CBC padding and decryp...

BestSafe Browser - Man In The Middle Remote Code Execution

Exploit Title: BestSafe Browser FREE NoAds - Remote Code Execution Date: 30/Jun/17 Exploit Author: MaXe Vendor Homepage: https://play.google.com/store/apps/details?id=a1.bestsafebrowser.com Software Link: See APK archive websites Screenshot: Refer to https://www.youtube.com/watch?v=VXNVzjsH0As...

eVestigator Forensic PenTester - Man In The Middle Remote Code Execution

eVestigator Forensic PenTester - Man In The Middle Remote Code Execution Exploit Title: eVestigator Forensic PenTester v1 - Remote Code Execution via MITM Date: 30/Jun/17 Exploit Author: MaXe Vendor Homepage: https://play.google.com/store/apps/details?id=penetrationtest.eVestigator.com Software...

eVestigator Forensic PenTester - Man In The Middle Remote Code Execution

Exploit Title: eVestigator Forensic PenTester v1 - Remote Code Execution via MITM Date: 30/Jun/17 Exploit Author: MaXe Vendor Homepage: https://play.google.com/store/apps/details?id=penetrationtest.eVestigator.com Software Link: See APK archive websites Screenshot: Refer to...

CVE-2017-7520

CVE-2017-7520 affects OpenVPN versions prior to 2.4.3 and prior to 2.3.17, enabling denial-of-service and/or a potentially sensitive memory leak triggered by a man-in-the-middle attacker. The connected advisories and trackers confirm patches/update guidance to mitigate by upgrading OpenVPN to ver...

Gratipay: Possible User Session Hijack using Invalid HTTPS certificate on inside.gratipay.com domain

Good evening team! This is a theoretical risk but I thought it was still worth reporting since every endpoint and any data flowing through inside.gratipay.com is unencrypted. POC https://inside.gratipay.com And every sub directory under inside.gratipay.com. Description Since the certificate is on...

Internet Bug Bounty: 4 severe remote + several minor OpenVPN vulnerabilities

CVE-2017-7521 Remote server crashes/double-free/memory leaks in certificate processing CVE-2017-7520 Remote including MITM client crash, data leak CVE-2017-7508 Remote server crash forced assertion failure CVE-2017-7522 Crash mbed TLS/PolarSSL-based server no cve Remote/mitm Null-pointer...

Inflection: Open Redirect through POST Request

The HTTP POST request to /oauth/authorize could be tampered with to allow an attacker to maliciously redirect the user to an arbitrary URL after failed authentication. Due to how the OAuth protocol works, the attacker would need to MITM or otherwise tamper with the request from a local network, a...

Gratipay: Possible user session hijack by invalid HTTPS certificate on inside.gratipay.com domain

Good evening team! This is a theoretical risk but I thought it was still worth reporting since every endpoint and any data flowing through inside.gratipay.com is unencrypted. POC https://inside.gratipay.com And every sub directory under inside.gratipay.com. Description Since the certificate is on...

Automated ettercap TCP/IP Hijacking Tool: Morpheus

morpheus framework automates tcp/udp packet manipulation tasks by using etter filters to manipulate target requests/responses under MitM attacks replacing the tcp/udp packet contents by our contents befor forward the packet back to the target host… workflow: 1. attacker - arp poison local lan mit...

Information disclosure

The "First State Bank of Bigfork Mobile Banking" by First State Bank of Bigfork app 4.0.3 -- aka first-state-bank-of-bigfork-mobile-banking/id1133969876 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive...

CVE-2017-9578

The "RVCB Mobile" by RVCB Mobile Banking app 3.0.0 -- aka rvcb-mobile/id757928895 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9573

The North Adams State Bank Ursa nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9572

The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Stellar.org: HTTP - Basic Authentication on https://www.stellar.org/wp-login.php

Greetings, noticed https://www.stellar.org/wp-login.php using basic authentication. PoC: YWRtaW46YWRtaW4= is base64 encode of admin:admin Impact: Vulnerable to client side attacks. Vulnerable to MITM attack. Vulenrable to Eavesdropping attack. Vulnerable to Brute force attacks. Fix: HTTP-Basic...

Parrot Sec: http://lists.parrotsec.org vulnerable to MITM

Thanks @nobodycares...

IBM Domino 8.5.x / 9.0.x < 9.0.1 Fix Pack 8 TLS Server Diffie-Hellman Key Validation MitM

According to its banner, the version of IBM Domino formerly IBM Lotus Domino running on the remote host is 8.5.x or 9.0.x prior to 9.0.1 Fix Pack 8. It is, therefore, affected by a flaw in the TLS server due to improper validation of Diffie-Hellman parameters. A man-in-the-middle MitM attacker ca...

Man In The Middle (MitM)

rocketmake-nuget is vulnerable to man-in-the-middle MitM attacks. These attacks are possible because they download resources over an insecure protocol...

Design/Logic Flaw

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the...

CVE-2017-5243

The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exchange and other important functions. As a result, it falls back to allowing ALL algorithms supported by the relevant version of OpenSSH and makes the...