CVE-2024-28067

CVE-2024-28067 concerns Samsung Exynos Modem 5300. The available documents describe a vulnerability where a Man-in-the-Middle attacker can downgrade the security mode of packets sent to the victim, enabling plaintext messaging. Affected software is specified as Samsung Exynos Modem 5300; the root...

SAMSUNG Mobile Processor, Wearable Processor and Modems Security Vulnerability

SAMSUNG Mobile Processor and SAMSUNG Wearable Processor are both products of the South Korean company SAMSUNG.SAMSUNG Mobile Processor is a series of mobile processors.SAMSUNG Wearable Processor is a series of wearable processors. SAMSUNG Mobile Processor is a series of mobile processors. A...

PT-2024-22248 · Samsung · Samsung Exynos Modem 5300

Name of the Vulnerable Software and Affected Versions: Samsung Exynos Modem 5300 affected versions not specified Description: A Man-in-the-Middle MITM attacker can exploit this issue to downgrade the security mode of packets going to the victim, enabling the attacker to send messages to the victi...

CVE-2024-28067

A vulnerability in Samsung Exynos Modem 5300 allows a Man-in-the-Middle MITM attacker to downgrade the security mode of packets going to the victim, enabling the attacker to send messages to the victim in plaintext...

The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the software-based monitoring and network traffic analysis server of SINEC Traffic Analyzer allows a perpetrator to perform a downgrade attack (an attack that reduces the version of the protocol used).

The vulnerability of the HSTS HTTP Strict Transport Security mechanism in the software web server for monitoring and analyzing network traffic in industrial networks, SINEC Traffic Analyzer, is related to the transmission of data in an open manner. Exploiting this vulnerability allows a malicious...

GO-2024-2479 Authentik vulnerable to PKCE downgrade attack in goauthentik.io

Authentik vulnerable to PKCE downgrade attack in goauthentik.io. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest an...

CVE-2024-36755

D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change the downloading URL via a man-in-the-middle attack...

WinSCP Terrapin Vulnerability - Windows

WinSCP is prone to a Terrapin vulnerability SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:winscp:winscp"; ifdescription...

CVE-2024-6153

Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2024-6153

Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2024-6153

CVE-2024-6153 affects Parallels Desktop Updater. The flaw is in the Updater service where version information is not properly validated before performing updates. This enables local attackers who can run low-privilege code to cause a downgrade and, potentially in conjunction with other vulnerabil...

CVE-2024-6153 Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability

Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2024-6153 Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability

Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrade Parallels software on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2024-35210

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information...

CVE-2024-35210

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information...

CVE-2024-35210

The CVE-2024-35210 affects Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) versions prior to V1.2. Root cause: the web server does not enforce HTTPS HSTS, enabling downgrade attacks that could expose confidential information. Impact is described as high (CVSS v3.1 base score 7.5; confidential...

CVE-2024-35210

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information...

CVE-2024-35210

A vulnerability has been identified in SINEC Traffic Analyzer 6GK8822-1BG01-0BA0 All versions V1.2. The affected web server is not enforcing HSTS. This could allow an attacker to perform downgrade attacks exposing confidential information...

PT-2024-4581 · Unknown · Sinec Traffic Analyzer

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V1.2 Description: A vulnerability has been identified in the web server of SINEC Traffic Analyzer, where it is not enforcing HSTS. This could allow an attacker to perform downgrade attacks, exposing...

PT-2024-6326 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: WolfSSL affected versions not specified Description: A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from...