CVE-2019-19135

In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows man in the middle attackers to reuse encrypted user credentials sent over the network...

CVE-2019-19135

CVE-2019-19135 concerns the OPC Foundation OPC UA .NET Standard stack (version 1.4.357.28) where servers do not generate sufficiently random numbers before 1.4.359.31. This weakness can allow a remote attacker to perform a MITM and reuse encrypted user credentials sent over the network. Public do...

Code injection

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack...

CVE-2019-10091

CVE-2019-10091 affects Apache Geode. When TLS is enabled and ssl-endpoint-identification-enabled is true, Geode may fail to verify hostnames in the certificate SAN during the SSL handshake, enabling potential man-in-the-middle scenarios and compromising intra-cluster communications. The issue is ...

CVE-2019-18863

The CVE-2019-18863 entry concerns a key-length vulnerability in the SRTP 128-bit key implementation on Mitel 6800/6900 SIP phones (versions 5.1.0.2051 SP2 and earlier). The root cause is in the SRTP key handling, enabling a man-in-the-middle attack when SRTP is used in a call, with potential inte...

Security Bulletin: Apache ActiveMQ Client used in IBM Jazz for Service Management could allow a remote attacker to conduct a man-in-the-middle attack (CVE-2018-11775)

Summary Apache ActiveMQ Client used in IBM Jazz for Service Management could allow a remote attacker to conduct a man-in-the-middle attack CVE-2018-11775 Vulnerability Details CVEID: CVE-2018-11775 DESCRIPTION: Apache ActiveMQ Client could allow a remote attacker to conduct a man-in-the-middle...

New LTE Network Flaw Could Let Attackers Impersonate 4G Mobile Users

A group of academics from Ruhr University Bochum and New York University Abu Dhabi have uncovered security flaws in 4G LTE and 5G networks that could potentially allow hackers to impersonate users on the network and even sign up for paid subscriptions on their behalf. The impersonation attack —...

Code injection

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attack...

CVE-2020-8809

Gurux GXDLMS Director pre-8.5.1905.1301 downloads updates over HTTP. A MITM can modify gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml, causing downloaded files to be altered. This can lead to code execution via add-ins, and via OBIS codes when combined with CVE-2020-8810. Connected sour...

Huawei EulerOS: Security Advisory for tomcat (EulerOS-SA-2020-1182)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple Security Vulnerabilities exist in IBM Cognos Insight

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 7. These issues were disclosed as part of the IBM Java SDK updates in October 2016 and January 2017. Multiple Open Source OpenSSL vulnerabilities have also been addressed. Vulnerability Details CVEID: CVE-2016-21...

CVE-2012-0063

The CVE-2012-0063 entry concerns tucan up to version 0.3.10, where an insecure plugin update mechanism can enable remote attackers to perform man-in-the-middle attacks and execute arbitrary code with the user’s privileges. The affected component is the plugin update process; root cause is lack of...

Design/Logic Flaw

In the Voatz application 2020-01-01 for Android, the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices, which makes it easier for remote attackers to discover this voter's choice by sniffing the network. Fo...

JVN#34535327: HtmlUnit vulenerable to arbitrary code execution

HtmlUnit is a Java-based library which provides web browser functionality to Java programs, and it supports JavaScript evaluation with embedded Mozilla Rhino engine. Mozilla Rhino engine offers a feature to make Java objects available from JavaScript. HtmlUnit initializes Rhino engine improperly,...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

Design/Logic Flaw

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

CVE-2019-13163

The CVE-2019-13163 entry describes a vulnerability in the Fujitsu TLS library that enables a man-in-the-middle attack affecting a range of Fujitsu products (e.g., Interstage components, Systemwalker suite, and related servers/workloads). The underlying issue is in the TLS library’s handling of cr...

CVE-2019-13163

The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions, Interstage Application Server V12 and other versions, Interstage Business Application Manager V2 and other versions, Interstage Information Integrator V...

CVE-2020-5720

CVE-2020-5720 concerns MikroTik WinBox (pre-3.21) with a path traversal flaw enabling creation of arbitrary files in directories that WinBox can write to. The vulnerability arises when the application processes paths without proper filtering, potentially exploited if the device connects to a mali...

Security Bulletin: Multiple OpenSSL and Non-OpenSSL vulnerabilities in Node.js included in Rational Application Developer for WebSphere Software

Summary OpenSSL vulnerabilities were disclosed on September 22 and 26, 2016 by the OpenSSL Project. OpenSSL is used by IBM SDK for Node.js. IBM SDK for Node.js has addressed the applicable CVEs, plus three additional vulnerabilities unrelated to the OpenSSL release. Vulnerability Details CVEID:...