6159 matches found
Security Bulletin: Multiple vulnerabilities in WebSphere Application Server Liberty affect IBM Spectrum Protect for Workstations Central Administration Console (CVE-2014-7810, CVE-2018-8039, CVE-2018-1901)
Summary IBM WebSphere Application Server Liberty is affected by Apache Tomcat, Apache CXF, and elevation of privileges vulnerabilities which affect the IBM Spectrum Protect for Workstations formerly Tivoli Storage Manager FastBack for Workstations Central Administration Console CAC. Vulnerability...
Slack: Slack DTLS uses a private key that is in the public domain, which may lead to SRTP stream hijack
Affects: Janus DTLS certificate Description The Janus server in use by Slack is configured using a certificate and private key that were previously distributed by default. This certificate is used to authenticate the DTLS connection which is later used to exchange keys for the SRTP stream. As a...
CVE-2019-1828
A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated, remote attacker to access administrative credentials. The vulnerability exists because affected devices use weak encryption algorithms for use...
CVE-2014-3603
CVE-2014-3603 involves improper hostname verification in Shibboleth IdP (HttpResource/FileBackedHttpResource) and OpenSAML Java 2.6.2, allowing MITM spoofing of SSL with arbitrary valid certs. IBM/Liberty-focused advisories confirm affected products and versions: Liberty for Java 3.37 and earlier...
Synology Android Moments Privilege Permission and Access Control Issues Vulnerability
Synology Android Moments is an Android-based application from Synology Inc. of Taiwan, China for viewing various documents stored in Synology Drive. A vulnerability exists in the privacy page of Synology Android Moments prior to version 1.2.3-199 due to privilege permission and access control...
Synology SSL VPN Client Privilege Permission and Access Control Issues Vulnerability
Synology SSL VPN Client is a VPN client software for secure connection to Synology NAS from Synology, Taiwan, China. A vulnerability exists in Synology SSL VPN Client with privilege permission and access control issues. An attacker can exploit this vulnerability to conduct a man-in-the-middle...
Design/Logic Flaw
Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the 1 command, 2 hostname, or 3 port parameter...
Code injection
Channel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments before 1.2.3-199 allows man-in-the-middle attackers to execute arbitrary code via unspecified vectors...
CVE-2018-13283
Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the 1 command, 2 hostname, or 3 port parameter...
Mozilla Firefox < 66.0 Multiple Vulnerabilities
Binary data 700487.prm...
CVE-2019-1748
CVE-2019-1748 affects Cisco IOS Software and Cisco IOS XE Software with the Network Plug-and-Play (PnP) agent. The root cause is insufficient certificate validation, allowing an unauthenticated, remote attacker to present a crafted certificate and perform man-in-the-middle attacks to decrypt/modi...
Security vulnerabilities fixed in Firefox 66 — Mozilla
A use-after-free vulnerability can occur when a raw pointer to a DOM element on a page is obtained using JavaScript and the element is then removed while still in use. This results in a potentially exploitable crash. The type inference system allows the compilation of functions that can cause typ...
Security Bulletin: Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF
Summary Public disclosed vulnerability from Nimbus-JOSE-JWT affects IBM Spectrum LSF Vulnerability Details CVE-2017-16007 BDSA-2017-0101 Nimbus JOSE+JWT implemented the ECDH-ES encryption option of the 'JSON Web Encryption' standard in a way that is vulnerable to cryptanalysis. This would enable ...
PT-2019-16874 · Ibm · Ibm Sterling B2B Integrator
Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 5.2.0.1 through 6.0.0.0 Standard Edition Description: The issue allows highly sensitive information to be transmitted in plain text. An attacker could obtain this information using man-in-the-middle...
F5 Networks BIG-IP : TMM TLS virtual server vulnerability (K10065173)
A BIG-IP virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited, this may result in plaintext recovery of encrypted messages through a man-in-the-middle MITM attack, despite the attacker not having gained access to t...
Reddit Gold: Alice and Bob, Caught in a Web of Lies
Alice and Bob, the beloved or not-so-beloved, depending placeholder characters often used in cryptography examples, have been spotted in the middle of a web of deceit and intrigue by eagle-eyed Redditers. Think lies. Broken hearts. Even…murder. Yep, you heard that right. It all starts with the...
CVE-2019-7728
The CVE-2019-7728 entry concerns the Bosch Smart Camera App for Android (before version 1.3.1). The root cause is improperly implemented TLS certificate checks, enabling the possibility of a man-in-the-middle attack on certain connections. Impact is described as partial confidentiality, integrity...
CVE-2019-1659
CVE-2019-1659 describes a certificate-validation flaw in the Cisco Prime Infrastructure (PI) SSL tunnel when the PI server is integrated with Identity Services Engine (ISE). The issue arises from improper validation of the server SSL certificate, enabling an unauthenticated, remote attacker to pe...
CVE-2019-1659 Cisco Prime Infrastructure Certificate Validation Vulnerability
A vulnerability in the Identity Services Engine ISE integration feature of Cisco Prime Infrastructure PI could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack against the Secure Sockets Layer SSL tunnel established between ISE and PI. The vulnerability is due to...