GHSA-2VQV-HP3P-FMV8 Downloads Resources over HTTP in webdriver-launcher

Affected versions of webdriver-launcher insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on...

Downloads Resources over HTTP in fis-parser-sass-bin

Affected versions of fis-parser-sass-bin insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

Downloads Resources over HTTP in tomita

Affected versions of tomita insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system...

Downloads Resources over HTTP in google-closure-tools-latest

Affected versions of google-closure-tools-latest insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

GHSA-G7W9-VM5M-48Q8 Downloads Resources over HTTP in arcanist

Affected versions of arcanist insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the syste...

GHSA-6JX3-RQCX-G3WW Downloads Resources over HTTP in air-sdk

Affected versions of air-sdk insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system...

Header Forgery in http-signature

Affected versions of http-signature contain a vulnerability which can allow an attacker in a privileged network position to modify header names and change the meaning of the request, without requiring an updated signature. This problem occurs because vulnerable versions of http-signature sign the...

Nginx < 1.6.1 SMTP STARTTLS Command Injection

According to the self-reported version in the server response header, the version of nginx installed on the remote host is 1.5.6 or higher, 1.6.x prior to 1.6.1, or 1.7.x prior to 1.7.4. It is, therefore, affected by a command injection vulnerability. A flaw exists in the function...

Cisco Wireless LAN Controller Software Elevation of Privilege Vulnerability

Cisco Wireless LAN Controller WLC is a wireless LAN controller product from Cisco USA. The product provides security policy, intrusion detection and other functions in the wireless LAN. An elevation of privilege vulnerability exists in Cisco Wireless LAN Controller Software due to the dynamic...

Siemens SPCanywhere App Vulnerabilities

OVERVIEW Karsten Sohr, Bernhard Berger, and Kai Hillmann from the TZI-Bremen, Kim Schlyter, Seyton Bradford, and Richard Warren from FortConsult, and Stefan Schuhmann have identified vulnerabilities in the Siemens SPCanywhere mobile application. Siemens has produced a new mobile application calle...

GHSA-8HJ4-W233-G35Q Downloads Resources over HTTP in react-native-baidu-voice-synthesizer

Affected versions of react-native-baidu-voice-synthesizer insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in...

Man-in-the-Middle(MitM)

ibapi is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists because it allows downloading of requested executable files via HTTP if there is a privileged network position for the attacker. It can subsequently open up a loophole for remote code execution since the attacker can...

Design/Logic Flaw

A vulnerability has been identified in Siveillance VMS Video for Android All versions V12.1a 2018 R1, Siveillance VMS Video for iOS All versions V12.1a 2018 R1. Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypt...

CVE-2018-4849

A vulnerability has been identified in Siveillance VMS Video for Android All versions V12.1a 2018 R1, Siveillance VMS Video for iOS All versions V12.1a 2018 R1. Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypt...

CVE-2018-4849

A vulnerability has been identified in Siveillance VMS Video for Android All versions V12.1a 2018 R1, Siveillance VMS Video for iOS All versions V12.1a 2018 R1. Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypt...

CVE-2018-4839

A vulnerability has been identified in DIGSI 4 All versions V4.92, EN100 Ethernet module DNP3 variant All versions V1.05.00, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module Modbus TCP variant All versions, EN100...

CVE-2018-4839

A vulnerability has been identified in DIGSI 4 All versions V4.92, EN100 Ethernet module DNP3 variant All versions V1.05.00, EN100 Ethernet module IEC 104 variant All versions, EN100 Ethernet module IEC 61850 variant All versions V4.30, EN100 Ethernet module Modbus TCP variant All versions, EN100...

Design/Logic Flaw

Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position...

CVE-2017-15397

Inappropriate implementation in ChromeVox in Google Chrome OS prior to 62.0.3202.74 allowed a remote attacker in a privileged network position to observe or tamper with certain cleartext HTTP requests by leveraging that position...

CVE-2017-15397

CVE-2017-15397 describes an issue in Google Chrome OS where the ChromeVox component allowed a remote attacker, positioned on the network, to observe or tamper with plaintext HTTP requests. Root cause is an inappropriate implementation within ChromeVox that mishandled plaintext network traffic. Th...