Man In The Middle (MitM)

paramiko is vulnerable to man-in-the-middle MitM attacks. These attacks are possible on the ssh client when gsskey=True, the server doesn't support gssapi-keyex and doesn't give any or no host key...

Bluetooth agreement flaws vulnerability:BlueBorne attack affected the number of 10 million Bluetooth equipped-vulnerability warning-the black bar safety net

! Description Armis Labs show an intrusion attack vector, such that the mounting tributary of the move, the desktop, and IoT operating systems include Android, iOS, Windows, Linux systems and equipment are subject to its influence. It is through the process of atmosphereairbornecan be spread, and...

Elastic Cloud Enterprise 1.0.2 security update

Elastic Cloud Enterprise unsecured communication ESA-2017-13 The client-forwarder in Elastic Cloud Enterprise versions prior to 1.0.2 do not properly encrypt traffic to ZooKeeper. If an attacker is able to man in the middle MITM the traffic between the client-forwarder and ZooKeeper they could...

Security Advisory - MITM Vulnerability in Huawei Themes App in Some Mobile Phones

The Themes App in some Huawei mobile phones has a man-in-the-middle MITM vulnerability due to the use of the insecure HTTP protocol for theme download. An attacker may exploit this vulnerability to tamper with downloaded themes. Vulnerability ID: HWPSIRT-2017-06263 This vulnerability has been...

Spoofing

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

CVE-2017-0902

CVE-2017-0902 is the RubyGems DNS hijacking vulnerability affecting RubyGems 2.6.12 and earlier. The issue allows a MITM attacker to redirect the RubyGems client to download and install gems from a server the attacker controls. Public advisories (e.g., ALAS-2017-915) document the vulnerability cl...

CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

CVE-2017-0902

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls...

RubyGems DNS request hijacking vulnerability

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to down load and install gems from a server that the attacker controls...

GSA Bounty: federalist.18f.gov vulnerable to Sweet32 attack

The researcher noted that federalist.18f.gov allows use of the TLSRSAWITH3DESEDECBCSHA cipher, which is now marked as "weak" in SSL labs because of risks of MitM attacks given this vulnerability: https://sweet32.info/, which requires monitoring of a long lived HTTPS connection. We inherit this...

py-kerberos -- DoS and MitM vulnerabilities

macosforgebot reports: The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service bad response, or have other unspecified impact by performing a man-in-the-middle attack...

McAfee Security Scan Plus < 3.11.587.1 Protection Level UI Element Download MitM Command Execution (TS102714)

The version of McAfee Security Scan Plus installed on the remote Windows host is prior to 3.11.587.1. It is, therefore, affected by a flaw that is triggered as HTML elements for displaying the Protection Level in the UI are requested using a cleartext protocol. This may allow a man-in-the-middle...

CVE-2017-9941

A vulnerability was discovered in Siemens SiPass integrated All versions before V2.70 that could allow an attacker in a Man-in-the-Middle position between the SiPass integrated server and SiPass integrated clients to read or modify the network communication...

CVE-2017-6873

A vulnerability was discovered in Siemens OZW672 all versions and OZW772 all versions that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle MITM attack on the integrated web server on port 443/tcp...

CVE-2017-6870

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android All versions before V1.0.2.2. The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle MitM attack...

CVE-2017-6873

A vulnerability was discovered in Siemens OZW672 all versions and OZW772 all versions that could allow an attacker to read and manipulate data in TLS sessions while performing a man-in-the-middle MITM attack on the integrated web server on port 443/tcp...