CVE-2024-47871 Insecure communication between the FRP client and server in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves insecure communication between the FRP Fast Reverse Proxy client and server when Gradio's share=True option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and rea...

TP-LINK Kasa KP125M和TP-LINK Tapo P125M 安全漏洞

TP-LINK Kasa KP125M and TP-LINK Tapo P125M are both a smart plug from China P&L TP-LINK. A security vulnerability exists in TP-LINK Kasa KP125M v1.0.3 and TP-LINK Tapo P125M v1.0.2, which stems from incorrect validation of certificates, and can be exploited by an attacker to eavesdrop on...

USN-7018-1 openssl vulnerabilities

Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie-Hellman ciphersuites in the TLS specification and implemented by OpenSSL contained a flaw. A remote attacker could possibly use this issue to eavesdrop on encrypted communications. This was fixed i...

Ubuntu 14.04 LTS : OpenSSL vulnerabilities (USN-7018-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7018-1 advisory. Robert Merget, Marcus Brinkmann, Nimrod Aviram, and Juraj Somorovsky discovered that certain Diffie- Hellman ciphersuites in the TLS specification and...

Ubuntu: Security Advisory (USN-7018-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WAON service app for Android fails to verify SSL server certificates

Overview WAON service app for Android provided by AEON CO., LTD. fails to verify SSL server certificates. Gaku Taniguchi of RiskFinder,inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle...

CVE-2024-7396

Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2...

CVE-2024-7396 Plaintext Communication

Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2...

CVE-2024-7396 Plaintext Communication

Missing encryption of sensitive data in Korenix JetPort 5601v3 allows Eavesdropping.This issue affects JetPort 5601v3: through 1.2...

CVE-2024-7396

CVE-2024-7396 concerns Korenix JetPort 5601v3 (affected through version 1.2) with missing encryption of sensitive data, enabling eavesdropping. The issue is caused by lack of encryption in data transmission for JetPort 5601v3 and is reflected in multiple sources (NVD, Red Hat CVE entry, CVE list)...

Unencrypted Data Transmission

Puncia is vulnerable to Unencrypted Data Transmission. The vulnerability is due to utilizing HTTP instead of HTTPS for communication, which could allow an attacker eavesdrops, perform data tampering, or access unauthorized data...

GHSA-RWCJ-7JJP-4W38 [PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

Impact APIURLS is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. References ISSUE PATCH...

CVE-2024-41124 Puncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. APIURLS is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. This issue has been addressed in release version 0.21 by...

CVE-2024-41124 Puncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. APIURLS is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. This issue has been addressed in release version 0.21 by...

CVE-2024-41124

CVE-2024-41124 affects the Puncia CLI (Official CLI for Subdomain Center & Exploit Observer) where API_URLS communicated over HTTP instead of HTTPS. Root cause: cleartext transmission enabling eavesdropping, data tampering, unauthorized data access, and MITM risks. The issue is mitigated in relea...

CVE-2024-41124 Puncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`

Puncia is the Official CLI utility for Subdomain Center & Exploit Observer. APIURLS is utilizing HTTP instead of HTTPS for communication that can lead to issues like Eavesdropping, Data Tampering, Unauthorized Data Access & MITM Attacks. This issue has been addressed in release version 0.21 by...

Longse NVR Security Vulnerability

Longse NVR is a series of network video recorders from China-based Longse Technology Longse. A security vulnerability exists in the Longse NVR that stems from transmitting a user's login and password to a remote control service without the use of any encryption, allowing an attacker to eavesdrop ...

CVE-2023-41926

The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials...

CVE-2023-41926

CVE-2023-41926 affects Kiloview P1/P2 devices with a web server that uses basic authentication over HTTP (port 80). Lack of encryption allows eavesdropping of credentials and potentially unauthorized access to the configuration interface. The CVSSv3.1 vector indicates network access, low attack c...

CVE-2023-41926 Insufficiently protected credentials in Kiloview P1/P2 devices

The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials...