PT-2023-11341

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.11.8 and earlier, 12.0.6 and earlier, 12.1.6 and earlier Description An issue was discovered in GitLab where cookies for GitLab Pages, which have access control, could be sent over cleartext...

AZL-34616 CVE-2022-43551 affecting package cmake for versions less than 3.21.4-10

A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...

AZL-12930 CVE-2022-43551 affecting package cmake for versions less than 3.21.4-3

A vulnerability exists in curl 7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in the URL. However, the HSTS mechanism could be bypasse...

CVE-2022-2338 Softing Secure Integration Server Cleartext Transmission of Sensitive Information

Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the session cookie in the request, which may...

CVE-2022-28861

The server in Citilog 8.0 allows an attacker in a man in the middle position between the server and its smart camera Axis M1125 to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server...

CVE-2022-28861: Cleartext Transmission of Sensitive Information

The server in Citilog 8.0 allows an attacker in a man in the middle position between the server and its smart camera Axis M1125 to see FTP credentials in a cleartext HTTP traffic. These can be used for FTP access to the server...

Incorrect Resource Transfer Between Spheres in Grails

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

GHSA-PMXF-4V8C-RWR7 Incorrect Resource Transfer Between Spheres in Grails

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP...

PT-2022-2737

Name of the Vulnerable Software and Affected Versions SICAM P850 versions prior to V3.00 SICAM P855 versions prior to V3.00 Description A vulnerability has been identified in the affected devices, which do not encrypt web traffic with clients but communicate in cleartext via HTTP. This could allo...

CVE-2021-40846

An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings...

Design/Logic Flaw

An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings...

CVE-2021-40846

An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings...

CVE-2021-40846

CVE-2021-40846 affects Rhinode Trading Paints up to version 2.0.36, where TP Updater.exe checks for and requests updates over cleartext HTTP. This enables a man-in-the-middle to substitute a malicious binary for the legitimate update without SSL warnings. The connected sources corroborate the sam...

PT-2022-11316

Name of the Vulnerable Software and Affected Versions Rhinode Trading Paints versions 2.0.36 and earlier Description An issue was discovered where TP Updater.exe uses cleartext HTTP to check and request updates. This allows attackers to perform a man-in-the-middle attack, enabling them to downloa...

CVE-2021-40846: Cleartext Transmission of Sensitive Information

An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check, and request, updates. Thus, attackers can man-in-the-middle a victim to download a malicious binary in place of the real update, with no SSL errors or warnings...

CVE-2021-40847

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

CVE-2021-40847: Cleartext Transmission of Sensitive Information

The update process of the Circle Parental Control Service on various NETGEAR routers allows remote attackers to achieve remote code execution as root via a MitM attack. While the parental controls themselves are not enabled by default on the routers, the Circle update daemon, circled, is enabled ...

CVE-2021-38142

Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured is not...

Remote code execution

Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured is not...

PT-2021-21962

Name of the Vulnerable Software and Affected Versions: Barco MirrorOp Windows Sender versions prior to 2.5.3.65 Description: The issue allows rogue software upgrades due to the use of cleartext HTTP, which is not secured with TLS. An attacker on the local network can achieve remote code execution...