Resources Downloaded Via Insecure Protocol

ec2-prices is vulnerable to man-in-the-middle attacks. It downloads resources over an unencrypted HTTP connection, allowing a man-in-the-middle attack to tamper with the content in transit...

Man-in-the-Middle (MitM)

nodux-core is susceptible to man-in-the-middle MitM attacks. It uses an insecure protocol to download resources. Not having a secure connection allows the attackers to trigger MitM and other possible attacks such as remote code execution RCE on the server...

Man In The Middle (MitM)

jser-stat is vulnerable to man-in-the-middle MitM attacks due to downloading data resources over an insecure protocol. It is possible for an attacker to intercept this connection and alter the packages received...

Resources Downloaded over Insecure Protocol

Overview Affected versions of igniteui download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection. Recommendation The igniteui package h...

Midea's i+ smart refrigerator has design logic flaws

The Midea i+ Smart Refrigerator is a smart home appliance developed by Midea Group. Midea's i+ Smart Refrigerator is susceptible to man-in-the-middle attacks due to the insecure protocol for transmitting data and the lack of validation of what is transmitted on the client and server side. The lac...

KLA10773 Code execution vulnerability in Apple Software Update

Weak networking protocol usage was found in Apple Software Update. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via man-in-the-middle attack. Technical details Instead of usage HTTPS for downloading updates unprotected...

Hughes Network Systems Broadband Global Area Network (BGAN) satellite terminal firmware contains multiple vulnerabilities

Overview Firmware developed by Hughes Network Systems used in a number of BGAN satellite terminals contains undocumented hardcoded login credentials CWE-798. Additionally, the firmware contains an insecure proprietary communications protocol, likely a debugging service, that allows unauthenticate...

Location bar spoofing vulnerabilities — Mozilla

Security researcher Jonathan Morgan reported that when a page loaded over an insecure protocol, such as http: or file:, sets its document.location to a https: URL which responds with a 204 status and empty response body, the insecure page will receive SSL indicators near the location bar, but wil...

Gentoo Security Advisory GLSA 200608-12 (x11vnc)

The remote host is missing updates announced in advisory GLSA 200608-12. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200608-05 (libvncserver)

The remote host is missing updates announced in advisory GLSA 200608-05. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200608-05 (libvncserver)

The remote host is missing updates announced in advisory GLSA 200608-05. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mac OS X insecure system update

Insecure uncrypted/unsigned protocol is used for system update...

Cisco VG248 login password is blank

The remote host is a Cisco VG248 with a blank password. SPDX-FileCopyrightText: 2005 Rick McCloskey Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only Cisco VG248 with a blank password nas...

Cisco VG248 Unpassworded Account

The remote host is a Cisco VG248 with a blank password. The Cisco VG248 does not have a password set and allows direct access to the configuration interface. An attacker could telnet to the Cisco unit and reconfigure it to lock the owner out as well as completely disable the phone system. Cisco...

Re: [VSA0304] Half-Life Client remote hole via Adminmod plugin

Dear VOID.AT Security, This bug is not related to adminmod, but is rather the bug in Half Life itself. At least absolutely same problem is in amx plugin. amxpsay ssss causes same trouble. So this is a bug in HalfLife client and may be exploited by malicious server operator including remote one wi...