CVE-2020-5367

Dell EMC Unisphere for PowerMax versions prior to 9.1.0.17, Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.17, and PowerMax OS Release 5978 contain an improper certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this...

CVE-2020-5869: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

In BIG-IQ 5.2.0-7.0.0, high availability HA synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit...

Balt-System NC series Data Transmission Disclosure

The vulnerability of the embedded software in Balt-System NC series numerical control systems is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to intercept traffic and disclose confidential information...

MonitorMinor: vicious stalkerware?

Updated March 17th, 2020 The other day, our Android traps ensnared an interesting specimen of commercial software that is positioned as a parental control app, but may also be used to secretly monitor family members or colleagues – or, in other words, for stalking. Such apps are often called...

Crafty Web Skimming Domain Spoofs “https”

Earlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that one of its Web sites had been hacked and retrofitted with code that steals credit card and login data. While such Web site card skimming attacks are not new, this intrusion leveraged a sneaky new...

WAGO e!Cockpit Network Communication Plaintext Transfer Vulnerability

Cockpit is an interactive server management interface. A network communications plaintext transfer vulnerability exists in WAGO e!Cockpit, which can be exploited by an attacker to intercept, interpret, and manipulate data from or to e...

CVE-2019-5107

A cleartext transmission vulnerability exists in the network communication functionality of WAGO e!Cockpit version 1.5.1.1. An attacker with access to network traffic can easily intercept, interpret, and manipulate data coming from, or destined for e!Cockpit. This includes passwords,...

PT-2020-11067

Name of the Vulnerable Software and Affected Versions WAGO e!Cockpit version 1.5.1.1 Description A cleartext transmission issue exists in the network communication functionality. An attacker with access to network traffic can intercept, interpret, and manipulate data, including passwords,...

Unspecified vulnerability in F5 BIG-IP ASM (CNVD-2019-47430)

F5 BIG-IP ASM is a Web Application Firewall WAF from F5 USA that provides secure remote access, protects email, and simplifies Web access control while enhancing network and application performance. A security vulnerability exists in F5 BIG-IP ASM version 15.0.1 that stems from the program not...

D Shield suffers from a webshell bypass vulnerability (CNVD-2020-01623)

D Shield is a proactive defense protection software designed specifically for IIS. D Shield suffers from a webshell bypass vulnerability that can be exploited by attackers to bypass the interception of submission data...

D Shield suffers from a webshell bypass vulnerability (CNVD-2020-01624)

D Shield is a proactive defense protection software designed specifically for IIS. D Shield suffers from a webshell bypass vulnerability that can be exploited by attackers to bypass the interception of submission data...

D Shield suffers from a webshell bypass vulnerability (CNVD-2020-02213)

D-Shield is a proactive defense software designed specifically for IIS to prevent websites and servers from being compromised by internal and external protection. D-Shield suffers from a webshell bypass vulnerability. An attacker can use this vulnerability to bypass the interception of submission...

Stripo Inc: SSL cookie without secure flag set

Issue background If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then t...

CVE-2019-5537

Sensitive information disclosure vulnerability resulting from a lack of certificate validation during the File-Based Backup and Restore operations of VMware vCenter Server Appliance 6.7 before 6.7u3a and 6.5 before 6.5u3d may allow a malicious actor to intercept sensitive data in transit over FTP...

CVE-2019-5537

Vulnerability: CVE-2019-5537 affects VMware vCenter Server Appliance 6.7 (before 6.7u3a) and 6.5 (before 6.5u3d), arising from lack of certificate validation in File-Based Backup and Restore, enabling an MITM attacker to intercept data in transit over FTPS/HTTPS. Connected advisory VMSA-2019-0018...

CVE-2019-12665

A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to read and modify data that should normally have been sent via an encrypted channel. The vulnerability is due to TCP port information not being considered when matching new...

Webshell Bypass Vulnerability in D-Shield

D Shield is a proactive defense protection software designed specifically for IIS. D Shield suffers from a webshell bypass vulnerability that can be exploited by attackers to bypass the interception of submission data...

CVE-2019-3751: Improper Certificate Validation

Dell EMC Enterprise Copy Data Management eCDM versions 1.0, 1.1, 2.0, 2.1, and 3.0 contain a certificate validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and...

CVE-2019-10964

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker...

CVE-2019-10964

Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker...