135 matches found
CVE-2025-1868
CVE-2025-1868 describes an NTLM leakage vulnerability in Famatech’s Advanced IP Scanner and Advanced Port Scanner. When a network scan is initiated, the tools may emit the NTLM hash of the scanning user, enabling an attacker to intercept traffic to a legitimate or fake server to extract the user ...
CVE-2021-35034
An insufficient session expiration vulnerability in the CGI program of the Zyxel NBG6604 firmware could allow a remote attacker to access the device if the correct token can be intercepted...
CVE-2022-20814
A vulnerability in the certificate validation of Cisco Expressway-C and Cisco TelePresence VCS could allow an unauthenticated, remote attacker to gain unauthorized access to sensitive data. The vulnerability is due to a lack of validation of the SSL server certificate that an affected device...
CVE-2024-6572
CVE-2024-6572 affects Checkmk where improper host key checking in the active check Check SFTP Service and the VNX quotas and filesystem agent can enable man-in-the-middle interception. Publicly documented remediation versions are Checkmk 2.3.0p15, 2.2.0p33, 2.1.0p48, with 2.0.0 as EOL. CVSS metri...
CVE-2024-22069
There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords...
PT-2024-19183 · Zte · Zte Zxv10 Xt802/Et301
Name of the Vulnerable Software and Affected Versions: ZTE ZXV10 XT802/ET301 product affected versions not specified Description: The issue is related to a permission and access control vulnerability. Attackers with common permissions can log in to the terminal web and change the administrator's...
The vulnerability of the RADIUS authentication protocol lies in the ability to bypass the authentication process by using capture-replay techniques to manipulate intercepted messages. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access by manipulating the authentication response.
The vulnerability of the RADIUS authentication protocol lies in the ability to bypass the authentication process by using capture-replay techniques to manipulate intercepted messages. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access by...
GHSA-8WXX-35QC-VP6R Missing key verification in gost
An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey...
GHSA-WRVH-RCMR-9QFC @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
Summary By combining two vulnerabilities an Open Redirect and session token sent as URL query parameter in Strapi framework is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction one click. Impact...
CVE-2024-2462
Allow attackers to intercept or falsify data exchanges between the client and the server...
RHEL 6 : log4j (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - log4j: Socket receiver deserialization vulnerability CVE-2017-5645 - Improper validation of certificate...
Selesta Visual Access Manager 安全漏洞
Selesta Visual Access Manager is a visual access manager from Selesta. A security vulnerability exists in Selesta Visual Access Manager, which can be exploited by an attacker to modify and receive ID-related computer POST parameters via POST HTTP request interception...
PT-2024-1285 · Nextcloud +2 · Nextcloud Server +2
Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions prior to 28.0.0 Description: The issue concerns the expiration of OAuth codes in Nextcloud Server, a self-hosted personal cloud system. In affected versions, OAuth codes did not expire, allowing an attacker who gains...
perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS
A flaw was found in Perl's CPAN, which doesn't check TLS certificates when downloading content. This happens due to verifySSL missing when suing the HTTP::Tiny library during the connection. This may allow an attacker to inject into the network path and perform a Man-In-The-Middle attack, causing...
CVE-2023-34758
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses...
CVE-2023-34758
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses...
Input validation
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses...
CVE-2023-34758
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses...
CVE-2023-32464
Dell VxRail, versions prior to 7.0.450, contain an improper certificate validation vulnerability. A high privileged remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and intercepting the victim's traffic to view o...