CVE-2007-4613

CVE-2007-4613 affects BEA WebLogic Server SSL libraries (versions 6.1 Gold–SP7, 7.0 Gold–SP7, 8.1 Gold–SP5). Vulnerability: an attacker in a MITM can obtain plaintext from an SSL stream by injecting crafted data and measuring timing of error responses. This is a separate issue from CVE-2006-2461....

CVE-2007-3150

Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refresh" that targets a www.google.com search for a local .exe file, which is displayed in the "results...

CVE-2007-3150

CVE-2007-3150 affects Google Desktop. The connected sources describe a user-assisted remote code execution via a man-in-the-middle attack that injects JavaScript, a Google search IFRAME, and a META HTTP-EQUIV="refresh" targeting a local executable. When the compromised link is clicked, Google Des...

CVE-2007-2513

Novell GroupWise 7 before SP2 20070524, and GroupWise 6 before 6.5 post-SP6 20070522, allows remote attackers to obtain credentials via a man-in-the-middle attack...

CVE-2006-7199

CVE-2006-7199 describes a MITM-based exposure in EMC RSA Secur ity SiteKey where a malicious, attacker-controlled proxy can relay authentication data to and from a legitimate SiteKey server, allowing an attacker to cause the correct image to be displayed remotely. The description notes the vendor...

CVE-2007-1558

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

CVE-2007-1099

dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks...

CVE-2007-1099

dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks...

CVE-2007-1099

Dropbear

Code injection

BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle MITM attack...

CVE-2006-5867

CVE-2006-5867 affects fetchmail prior to 6.3.6-rc4, where TLS enforcement was inadequate and could transmit cleartext passwords over unsecured links, enabling password disclosure via MITM. Connected advisories confirm updated fetchmail packages with TLS enforcement (e.g., enabling TLS1) to fix th...

Mozilla Thunderbird: Multiple vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla Project. Description It has been identified that Mozilla Thunderbird improperly handles Script objects while they are being executed, allowing them to be modified during execution. JavaScript is disabled in...

VMSA-2006-0010 - SSL sessions not authenticated by VC Clients

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2006-0010 Synopsis: SSL sessions not authenticated by VC Clients Patch URL:http://www.vmware.com/download/vi/vc-201-200611-patch.html...

CVE-2006-3415

Tor before 0.1.1.20 uses improper logic to validate the "OR" destination, which allows remote attackers to perform a man-in-the-middle MITM attack via unspecified vectors...

CVE-2006-2703

The CVE-2006-2703 entry concerns the RedCarpet command-line client (rug), where the SSL certificate verification is not performed by the client when connecting to a server. This weaknesses permits a MITM attacker to read traffic and potentially execute commands through the intercepted connection....

CVE-2006-0231

Symantec Scan Engine 5.0.0.24 (and possibly earlier versions before 5.1.0.7) uses the same private DSA key for all installations, enabling remote attackers to perform man-in-the-middle attacks and decrypt communications. Root cause: a single immutable DSA private key embedded in the SSL server ac...

CVE-2004-2621

Nortel Contivity VPN Client 2.1.7, 3.00, 3.01, 4.91, and 5.01, when opening a VPN tunnel, does not check the gateway certificate until after a dialog box has been displayed to the user, which creates a race condition that allows remote attackers to perform a man-in-the-middle MITM attack...

CVE-2002-2125

In the provided documents, CVE-2002-2125 affects Internet Explorer 6.0 . The vulnerability occurs when an expired certificate authority (CA) certificate is submitted to the user while a newer CA certificate already exists in the local store, and IE does not warn the user. This can allow remote at...

CVE-2005-2969

The SSL/TLS server implementation in OpenSSL 0.9.7 before 0.9.7h and 0.9.8 before 0.9.8a, when using the SSLOPMSIESSLV2RSAPADDING option, disables a verification step that is required for preventing protocol version rollback attacks, which allows remote attackers to force a client and server to u...

OpenSSL Version Rollback and Weak Cryptographic Algorithm Vulnerabilities

OpenSSL contains vulnerabilities that could allow an unauthenticated, remote attacker to bypass security restrictions. The first vulnerability CVE-2005-2969 affects any application using a SL/TLS server implementation provided by OpenSSL versions 0.9.7g and prior. If these implementations have...