CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1...

CVE-2020-5869: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

In BIG-IQ 5.2.0-7.0.0, high availability HA synchronization is not secure by TLS and may allow on-path attackers to read / modify confidential data in transit...

CVE-2020-5865

In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle MiTM attacks...

CVE-2020-5865

In versions prior to 3.3.0, the NGINX Controller is configured to communicate with its Postgres database server over unencrypted channels, making the communicated data vulnerable to interception via man-in-the-middle MiTM attacks...

Xilinx Programmable Integrated Circuits Intercept File Control

The vulnerability of the programmable user-programmable gate array PPVM for Xilinx Spartan, Artix, Kintex, and Virtex programmable logic integrated circuits lies in the ability to intercept or replace the file containing the encrypted control bitstream. Exploiting this vulnerability can allow an...

ansible: path injection on dest parameter in fetch module

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node...

Another Story of Bad 1970s Encryption

This one is from the Netherlands. It seems to be clever cryptanalysis rather than a backdoor. The Dutch intelligence service has been able to read encrypted communications from dozens of countries since the late 1970s thanks to a microchip, according to research by de Volkskrant on Thursday. The...

Apple iOS, macOS Mojave and tvOS 802.1X Component Input Validation Error Vulnerability

Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system.Apple macOS Mojave is a specialized operating system developed for Mac computers.Apple macOS Mojave is an operating system developed for Mac computers.Apple tvOS is a smart TV operating...

CVE-2019-6203

A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged network position may be able to intercept network traffic...

CVE-2019-6203

A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged network position may be able to intercept network traffic...

Code injection

A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged network position may be able to intercept network traffic...

CVE-2019-6203

A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. An attacker in a privileged network position may be able to intercept network traffic...

CVE-2019-6203

CVE-2019-6203 affects Apple devices via the 802.1X component, where a logic/state-management issue could allow a privileged network-position attacker to intercept traffic. Apple’s security pages tie this to iOS 12.2, macOS Mojave 10.14.4, and tvOS 12.2, with fixes in those releases. The CVE is do...

PT-2020-11200

Name of the Vulnerable Software and Affected Versions iOS versions prior to 12.2 macOS Mojave versions prior to 10.14.4 tvOS versions prior to 12.2 Description A logic issue was addressed with improved state management. An attacker in a privileged network position may be able to intercept network...

CVE-2020-7113

A vulnerability was found when an attacker, while communicating with the ClearPass management interface, is able to intercept and change parameters in the HTTP packets resulting in the compromise of some of ClearPass' service accounts. Resolution: Fixed in 6.7.10, 6.8.1, 6.9.0 and higher...

CVE-2020-7113

The CVE-2020-7113 entry describes a vulnerability in Aruba Networks ClearPass (management interface) where an attacker can intercept and modify HTTP parameters, leading to compromise of some ClearPass service accounts. Affected versions include ClearPass Policy Manager prior to the fixed releases...

GHSA-Q8XG-8XWF-M598 Machine-In-The-Middle in lix

All versions of lix are vulnerable to Machine-In-The-Middle. The package accepts downloads with http and follows location header redirects for package downloads. This allows for an attacker in a privileged network position to intercept a lix package installation and redirect the download to a...

Balt-System NC series Data Transmission Disclosure

The vulnerability of the embedded software in Balt-System NC series numerical control systems is related to the transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to intercept traffic and disclose confidential information...

CVE-2020-11611

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage function in xdLocalStorage.js specifies the wildcard as the targetOrigin when calling the postMessage function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages...