4336 matches found
CVE-2018-11422
CVE-2018-11422 affects Moxa OnCell G3100-HSPA Series (versions 1.6 Build 17100315 and earlier). The vulnerability arises from a proprietary configuration protocol that provides no confidentiality, integrity, or authenticity—info is sent in plain text and can be intercepted or modified. Commands s...
Firefox to Automatically Trust OS-Installed CA Certificates to Prevent TLS Errors
Mozilla has finally introduced a mechanism to let Firefox browser automatically fix certain TLS errors, often triggered when antivirus software installed on a system tries to intercept secure HTTPS connections. Most Antivirus software offers web security feature that intercepts encrypted HTTPS...
CVE-2019-10964
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker...
CVE-2019-10964
Medtronic MiniMed Insulin Pumps are designed to communicate using a wireless RF with other devices, such as blood glucose meters, glucose sensor transmitters, and CareLink USB devices. This wireless RF communication protocol does not properly implement authentication or authorization. An attacker...
Authentication flaw
In Medtronic MinMed 508 and Medtronic Minimed Paradigm Insulin Pumps, Versions, MiniMed 508 pump – All versions, MiniMed Paradigm 511 pump – All versions, MiniMed Paradigm 512/712 pumps – All versions, MiniMed Paradigm 712E pump–All versions, MiniMed Paradigm 515/715 pumps–All versions, MiniMed...
CVE-2019-10964
CVE-2019-10964 affects Medtronic MiniMed insulin pumps (508 and Paradigm series, and related models) via an improper access control weakness in wireless RF communications. The vulnerability allows an attacker with adjacent access to inject, replay, modify, or intercept data and potentially change...
Security feature bypass
IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. An attacker by intercepting the subsequent requests can bypass business logic to modify the pattern to unlocked state. IBM X-Force ID: 159416...
CVE-2019-10270
An arbitrary password reset issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It is possible due to lack of verification and correlation between the reset password key sent by mail and the userid parameter to reset the password of another user. One only needs to know the...
PT-2019-8251
Name of the Vulnerable Software and Affected Versions ASUS Vivobaby versions prior to 1.1.09 Description The issue concerns Missing SSL Certificate Validation in the ASUS Vivobaby application. This means the application does not properly validate the SSL certificates of the servers it connects to...
Modicon Insufficiently Random Values Intercept TCP Connections
The vulnerability of the microprogrammed programmable logic controller Modicon is related to the use of insufficiently random values. Exploiting this vulnerability could allow a malicious actor to intercept TCP connections remotely...
qpid-proton: TLS Man in the Middle Vulnerability
A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...
qpid-proton: TLS Man in the Middle Vulnerability
A cryptographic weakness was discovered in qpid-proton's use of TLS. If the qpid-proton client was used without client certificates, it would accept an anonymous cipher offered by the server. A man-in-the-middle attacker could use this to silently intercept traffic that should have been encrypted...
Jingdong Financial App has a logic flaw vulnerability
Jingdong Finance APP is an investment software. A logic flaw vulnerability exists in Jingdong Financial APP. Allows attackers to bypass real-name verification by intercepting packets using proxy tools...
Security Advisory - MITM Vulnerability on Huawei Share
There is a man-in-the-middleMITM vulnerability on Huawei Share of certain smartphones. When users establish connection and transfer data through Huawei Share, an attacker could sniffer, spoof and do a series of operations to intrude the Huawei Share connection and launch a man-in-the-middle attac...
The False Promise of “Lawful Access” to Private Data
Opinion: As online extremism migrates to real-world violence, some suggest letting law enforcement intercept encrypted messages. But that’s a dangerous proposition...
PHP-Fusion 9.03.00 - Edit Profile Remote Code Execution (Metasploit)
PHP-Fusion 9.03.00 - Edit Profile Remote Code Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "PHP-Fusion %q This module exploits command execution vulnerability in PHP-Fusi...
PHP-Fusion 9.03.00 Remote Code Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "PHP-Fusion %q This module exploits command execution vulnerability in PHP-Fusion 9.03.00 and prior versions. It is possible to execute commands i...
PT-2019-2270
Name of the Vulnerable Software and Affected Versions Microsoft Dynamics affected versions not specified Description The issue is related to security configuration errors in Microsoft Dynamics, allowing a remote attacker to bypass existing restrictions on email attachments by intercepting a POST...
CVE-2018-4069
CVE-2018-4069 is an information-disclosure vulnerability in Sierra Wireless AirLink ES450 ACEManager authentication. The flaw stems from sending authentication data in plaintext XML over HTTP to the web server, enabling an attacker who can sniff network traffic upstream to access credentials. Pub...