4295 matches found
ROS-20240904-11
A vulnerability in the implementation of the PEAP Protected Extensible Authentication Protocol protocol of the Wi-Fi WPA Supplicant client is caused by flaws in the authorization procedure. Wi-Fi WPA Supplicant is caused by a flaw in the authorization procedure. Exploitation of the vulnerability...
PT-2024-9564 · Veeam · Veeam Backup & Replication
Name of the Vulnerable Software and Affected Versions: Veeam Backup & Replication affected versions not specified Description: An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive credentials during restore...
Dorsett Controls InfoScan < 1.38 Multiple Vulnerabilities (July 2024)
The version of Dorsett Controls InfoScan running on the remote host is prior to 1.38. It is, therefore, affected by multiple vulnerabilities: - Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys. CVE-2024-392...
Improper Validation Of Integrity Check Value
org.apache.sshd, sshd-common is vulnerable for Improper Validation Of Integrity Check Value. The vulnerability is due to the possibility of packet interception, where an attacker can intercept traffic between the client and server and drop certain packets from the stream, potentially downgrading ...
CVE-2024-41909 Apache MINA SSHD: integrity check bypass
Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traffic between client and server could drop certain packets from the stream, potentially causing client and server to consequently end up with...
CVE-2024-41909
CVE-2024-41909 references a Terrapin-like downgrade risk in SSH streams similar to CVE-2023-48795, where an attacker intercepting traffic could cause packet drops that lead to downgraded or disabled security features on both client and server ends. Technical details in the connected documents sho...
N-able Ecosystem Agent 安全漏洞
N-able Ecosystem Agent is an agent system from N-able Canada. A security vulnerability exists in N-able Ecosystem Agent that stems from not properly validating SSL/TLS certificates, which could allow a malicious actor to perform man-in-the-middle operations and intercept traffic between the agent...
CVE-2024-42408
The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure...
CVE-2024-42408
The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure...
CVE-2024-42408 Dorsett Controls InfoScan Path Traversal
The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure...
CVE-2024-42408
The CVE-2024-42408 issue affects Dorsett Controls InfoScan (pre-1.38): the InfoScan client download page can be intercepted by a proxy, exposing locally stored filenames and potentially leading to information exposure. Root cause: path traversal in the download page handling allows leakage when a...
CVE-2024-22069
CVE-2024-22069 affects ZTE ZXV10 XT802/ET301. The issue is a permission and access control vulnerability allowing a user with common permissions to log in to the terminal web interface and illegally change the administrator password by intercepting password-change requests. Reported as a network-...
Data Interception And Manipulation
Gorush is vulnerable to Data Interception and Manipulation. The vulnerability is due to the use of a deprecated TLS version in the RunHTTPServer function within servernormal.go, which allows an attacker to intercept and manipulate data...
PT-2024-36335 · N Able · Ecosystem Agent
Name of the Vulnerable Software and Affected Versions: Ecosystem Agent versions 4.0 through 4.1.5.2597 Ecosystem Agent versions 5.0 through 5.1.4.2473 Description: The issue is related to the improper validation of SSL/TLS certificates. This could allow a malicious actor to perform a...
CVE-2024-22069: Improper Privilege Management
There is a permission and access control vulnerability of ZTE's ZXV10 XT802/ET301 product.Attackers with common permissions can log in the terminal web and change the password of the administrator illegally by intercepting requests to change the passwords...
CVE-2024-42408: Improper Limitation of a Pathname to a Restricted Directory
The InfoScan client download page can be intercepted with a proxy, to expose filenames located on the system, which could lead to additional information exposure...
PT-2024-29931
Name of the Vulnerable Software and Affected Versions InfoScan affected versions not specified Description The issue allows an attacker to intercept the InfoScan client download page using a proxy, potentially exposing filenames on the system and leading to additional information exposure...
Gorush uses deprecated TLS versions
An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version...
GHSA-P3PF-MFF8-3H47 Gorush uses deprecated TLS versions
An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version...