6159 matches found
CVE-2016-6585
CVE-2016-6585 affects Symantec Norton Mobile Security for Android before 3.16. The vulnerability could let a remote attacker perform a man-in-the-middle attack via specially crafted JavaScript, leading to a denial of service (potential application crash) as described in multiple sources. The exac...
CVE-2016-6585
A Denial of Service vulnerability exists in Symantec Norton Mobile Security for Android prior to 3.16, which could let a remote malicious user conduct a man-in-the-middle attack via specially crafted JavaScript...
MGASA-2020-0018 Updated jss packages fix security vulnerability
Updated jss packages fix security vulnerability: A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be...
CVE-2014-0104
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fenceciscoucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates...
GHSA-HH3J-X4MC-G48R Insufficiently Protected Credentials in Apache Tomcat
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...
Insufficiently Protected Credentials in Apache Tomcat
When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user...
CVE-2019-6032
The CVE-2019-6032 entry affects the Android App “NTV News24” prior to Ver.3.0.0, which fails to verify SSL server certificates (CWE-295). This enables a MITM attacker to spoof servers and eavesdrop or obtain sensitive data. Affected: NTV News24 Android app (prior to 3.0.0). Root cause: improper c...
Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.1.28 openshift-enterprise-builder-container security update
An update for the openshift-enterprise-builder container is now available for Red Hat OpenShift Container Platform 4.1. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
Security Bulletin: Multiple Vulnerabilities in Samba affect IBM i
Summary Samba is supported on IBM i. IBM i has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2017-15275 DESCRIPTION: Samba could allow a remote attacker to obtain sensitive information, caused by a heap memory information leak. By sending a specially crafted request, an attacker...
CVE-2019-18833
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure issue 2 of 2.. The encryption key of the media content which is shared between a ClickShare Button and a ClickShare Base Unit is randomly generated for each new session and communicated over a TLS connection. An...
CVE-2019-18833
Barco ClickShare Button R9861500D01 devices before 1.9.0 allow Information exposure issue 2 of 2.. The encryption key of the media content which is shared between a ClickShare Button and a ClickShare Base Unit is randomly generated for each new session and communicated over a TLS connection. An...
CVE-2019-16732
Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user...
CVE-2019-16732
The CVE-2019-16732 entry describes an unencrypted HTTP channel for firmware upgrades in Petalk AI and PF-103, enabling a man-in-the-middle to inject and execute arbitrary code with root privileges. Affected components are the firmware upgrade process on Petalk AI and PF-103 devices; root cause is...
Security Advisory - Improper Authentication Vulnerability in Several Products
There is an improper authentication vulnerability in several products. The device does not perform a sufficient authentication when doing certain operation, successful exploit could allow an attacker to cause the device to reboot after launch a man in the middle attack. Vulnerability ID:...
Magecart Group Switches Up Tactics with MiTM, Phishing
A fresh splinter group under the Magecart umbrella has been discovered ramping up activity starting in August-September of 2019. It’s using a unique codebase and different tactics to carry out its attacks, according to researchers. Magecart is an umbrella term encompassing several different threa...
CVE-2011-3374
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack...
CVE-2011-3374
It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack...
Fixed in Apache Tomcat 8.5.49
Note: The issue below was fixed in Apache Tomcat 8.0.48 but the release vote for the 8.0.48 release candidate did not pass. Therefore, although users must download 8.0.49 to obtain a version that includes the fix for this issue, version 8.0.48 is not included in the list of affected versions...
Improper Hostname Validation
nusoap does not properly validate hostnames. This is due to incorrect configuration of the CURLOPTSSLVERIFYHOST parameter, leading to improper validation of hostname of a certificat3e and allowing an attacker to perform Man-in-the-Middle MitM attacks...