CVE-2024-44097

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. T...

CVE-2024-44097

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. T...

CVE-2024-44097

CVE-2024-44097 : Google Nest devices are affected by a TLS trust-management flaw where the application fails to properly validate the server certificate during TLS initialization, allowing a network attacker to intercept and read data and potentially forward or inject modified data to the real se...

CVE-2024-44097

According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. T...

Google Nest 安全漏洞

Google Nest is a smart home product from the American company Google Google. Google Nest suffers from a trust management issue vulnerability that stems from the application failing to properly validate the server certificate when initializing a TLS connection, which can be exploited by a cyber...

Cisco Nexus Dashboard 安全漏洞

Cisco Nexus Dashboard is a single console from Cisco, Inc. It can simplify the operation and management of data center networks. A security vulnerability exists in Cisco Nexus Dashboard that stems from the Cisco NDO Verify Peer Certificates site management feature authenticating only when adding ...

USN-7050-1 ruby-devise-two-factor vulnerabilities

Benoit Côté-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could possibly use this issue to intercept and re-use a one-time password. CVE-2021-43177 Garrett Rappaport discovered that Devise-Two-Factor incorrectly handled...

Ubuntu 20.04 LTS / 22.04 LTS : Devise-Two-Factor vulnerabilities (USN-7050-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7050-1 advisory. Benoit Ct-Jodoin and Michael Nipper discovered that Devise-Two-Factor incorrectly handled one-time password validation. An attacker could...

CVE-2024-8455

The swctrl service is used to detect and remotely manage PLANET Technology devices. For certain switch models, the authentication tokens used during communication with this service are encoded user passwords. Due to insufficient strength, unauthorized remote attackers who intercept the packets ca...

The vulnerability of the microprogrammed logic controller (PLC) Advantech ADAM-5630 software, related to the falsification of inter-site requests, allows a intruder to intercept the user’s session.

The vulnerability of the microprogrammed logic controller PLC Advantech ADAM-5630 software is related to the manipulation of intersite requests. Exploiting this vulnerability allows a malicious actor to intercept the user’s session remotely...

CVE-2024-47126

The goTenna Pro App does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast of an...

CVE-2024-47125 Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro

The goTenna Pro App does not authenticate public keys which allows an unauthenticated attacker to manipulate messages. It is advised to update your app to the current release for enhanced encryption protocols...

CVE-2024-20350

A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability...

CVE-2024-20350 Cisco Catalyst Center Static SSH Host Key Vulnerability

A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability...

Server-Side Request Forgery (SSRF)

litellm is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to lack of validation or restriction on the apibase parameter in POST /chat/completions, allowing a malicious user to intercept the OpenAI API key by redirecting requests to their own domain...

CVE-2024-45101

A privilege escalation vulnerability was discovered when Single Sign On SSO is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL...

CVE-2024-45101

The CVE-2024-45101 issue affects Lenovo XClarity Administrator (LXCA) where enabling Single Sign-On (SSO) can lead to privilege escalation by intercepting a valid authenticated user’s XCC session. The vulnerability arises when a user is tricked into clicking a specially crafted URL, enabling an a...

CVE-2024-45101

A privilege escalation vulnerability was discovered when Single Sign On SSO is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL...

CVE-2024-6587 SSRF in berriai/litellm

A Server-Side Request Forgery SSRF vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the apibase parameter when making requests to POST /chat/completions, causing the application to send the request to the domain specified by apibase. This request...

CVE-2024-6587 SSRF in berriai/litellm

A Server-Side Request Forgery SSRF vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the apibase parameter when making requests to POST /chat/completions, causing the application to send the request to the domain specified by apibase. This request...