Information disclosure

An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to perform a man-in-the-middle attack, thereby stealing authentic credentials from encrypted paths which are easily decrypted,...

CVE-2017-2334

An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to perform a man-in-the-middle attack, thereby stealing authentic credentials from encrypted paths which are easily decrypted,...

CVE-2017-2334

The CVE-2017-2334 entry affects Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1. An attacker on the network may leverage an information-disclosure flaw to perform a man-in-the-middle attack, stealing credentials from encrypted paths and potentially gaining ...

CVE-2017-2334

An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to perform a man-in-the-middle attack, thereby stealing authentic credentials from encrypted paths which are easily decrypted,...

CVE-2016-1210

CVE-2016-1210 affects the 105 BANK App for Android (1.0/1.1) and iOS (1.0), where X.509 certificate validation is not performed when connecting to SSL servers. This allows a man-in-the-middle attacker to spoof servers and potentially eavesdrop on encrypted communications. The underlying issue is ...

Apple Mac OS X Multiple Vulnerabilities-02 (Apr 2017)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2017-2387

The CVE covers Apple Music for Android (com.apple.android.music) prior to version 2.0, where the app does not verify X.509 SSL certificates, enabling potential MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The issue is tied to certificate validation i...

CVE-2017-3204

The Go SSH library x/crypto/ssh by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism...

CVE-2017-2412

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "iTunes Store" component. It allows man-in-the-middle attackers to modify the client-server data stream to iTunes sandbox web services by leveraging use of cleartext HTTP...

Code injection

An issue was discovered in certain Apple products. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. The issue involves cleartext client-certificate transmission in the "APNs Server" component. It allows man-in-the-middle attackers to track users via correlation...

CVE-2017-2448

CVE-2017-2448 is an Apple Keychain vulnerability affecting iOS < 10.3, macOS < 10.12.4, and tvOS

CVE-2017-2383

The CVE-2017-2383 entry applies to Apple iCloud before 6.2 on Windows and iTunes before 12.6 for Windows. The underlying issue is cleartext transmission of a client certificate in the APNs Server component, enabling a network-position attacker to track a user via correlation of the certificate. A...

CVE-2015-0863

CVE-2015-0863 concerns Samsung GALAXY Apps (aka Samsung Apps, Samsung Updates, or com.sec.android.app.samsungapps). Multiple sources confirm a vulnerability in versions before 14120405.03.012 that enables man‑in‑the‑middle (MITM) attacks to both obtain sensitive information and execute arbitrary ...

CVE-2016-10130

CVE-2016-10130 affects libgit2: the http_connect path in transports/http.c allows a MITM by clobbering the error variable. Versions before 0.24.6 and 0.25.x before 0.25.1 are vulnerable. Impact: spoofed certificates/possible remote compromise; remediation: upgrade libgit2 to 0.24.6+ (or 0.25.1+ i...

PT-2017-09: Information Disclosure in Hirschmann Automation and Control GmbH Classic Platform Switches

The specialists of the Positive Research center have detected an Information Disclosure vulnerability in Hirschmann Automation and Control GmbH Classic Platform Switches. A cleartext transmission of information vulnerability in the web interface of Belden Hirschmann RS, RSR, RSB, MACH100, MACH100...

CVE-2015-8987

McAfee Agent (MA) for non-Mac OS, version 4.8.0 patch 2 and earlier, is affected by a MitM vulnerability that lets an attacker cause a MA instance to communicate with a rogue ePO server via migration to another ePO server. The OpenVAS entry and NVD record corroborate the MITM impact but do not pr...

Hackers with Credit Card Scrapers Continue to Target Magento

Attackers continue to take aim at the e-commerce platform Magento. Researchers said last week they came across a malicious function snuck into one of the platform’s modules in order to steal credit card information. Code for the function was injected into a .php file for SF9 Realex, a module that...

FreeBSD : mbed TLS (PolarSSL) -- multiple vulnerabilities (f41e3e54-076b-11e7-a9f2-0011d823eebd)

Janos Follath reports : - If a malicious peer supplies a certificate with a specially crafted secp224k1 public key, then an attacker can cause the server or client to attempt to free block of memory held on stack. Depending on the platform, this could result in a Denial of Service client crash or...

Information disclosure

An issue was discovered on Dahua DHI-HCVR7216A-S3 3.210.0001.10 build 2016-06-06 devices. The Dahua DVR Protocol, which operates on TCP Port 37777, is an unencrypted, binary protocol. Performing a Man-in-the-Middle attack allows both sniffing and injections of packets, which allows creation of...

JVN#82619692: Access CX App fails to verify SSL server certificates

Access CX App provided by NISSAN SECURITIES CO., LTD. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Application Update to the latest version according to the information provided by...