The vulnerability of the web interface of Netgear C7800 router software allows a attacker to execute a type of “man-in-the-middle” attack.

The vulnerability of the web interface of Netgear C7800 router software lies in the deficiencies in the authentication process. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” type attack...

Bosscomm IF740 安全漏洞

Bosscomm IF740 is an OBD2 scanner for automotive diagnostics from Bosscomm. It can read codes for automotive engine, SRS, ABS, TCM, etc. A security vulnerability exists in the Bosscomm IF740 that stems from communications being sent in clear text, which could lead to a man-in-the-middle attack...

emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect...

CVE-2025-25728

CVE-2025-25728 involves Bosscomm IF740 firmware (versions 11001.7078 and v11001.0000) and System versions 6.25 and 6.00 where the device’s update API traffic is sent in plaintext, enabling MITM access to sensitive information. Related Red Hat advisories describe additional issues in the same prod...

Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100

Brocade ASCG before 3.2.0 WebGui is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and...

CVE-2025-25728

Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintext, allowing attackers to access sensitive information via a man-in-the-middle attack...

PT-2025-9044 · Bosscomm · Bosscomm If740 System +1

Name of the Vulnerable Software and Affected Versions: Bosscomm IF740 Firmware versions 11001.7078 through 11001.0000 Bosscomm IF740 System versions 6.25 through 6.00 Description: The issue allows attackers to access sensitive information via a man-in-the-middle attack because communications to t...

CVE-2025-25728

Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the update API in plaintext, allowing attackers to access sensitive information via a man-in-the-middle attack...

ALSA-2025:1917 Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme CVE-2025-1244 For...

Important: emacs security update

GNU Emacs is a powerful, customizable, self-documenting text editor. It provides special code editing features, a scripting language elisp, and the capability to read e-mail and news. Security Fixes: emacs: Shell Injection Vulnerability in GNU Emacs via Custom "man" URI Scheme CVE-2025-1244 For...

CVE-2024-55581

When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate unless the using program specifies a TLS configuration...

CVE-2024-55581

When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate unless the using program specifies a TLS configuration...

DEBIAN-CVE-2024-55581

When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate unless the using program specifies a TLS configuration...

UBUNTU-CVE-2024-55581

When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate unless the using program specifies a TLS configuration...

CVE-2024-50691

SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certificate errors and is vulnerable to MiTM attacks. Attackers can impersonate the iSolarCloud server and communicate with the Android app...

CVE-2024-55581

When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate unless the using program specifies a TLS configuration...

CVE-2024-55581

CVE-2024-55581 affects AdaCore Ada Web Server 25.0.0 when linked with GnuTLS, where AWS.Client defaults do not verify the HTTPS server certificate, enabling MITM attacks if TLS configuration is not explicitly set. Root cause: insecure defaults in AWS.Client with GnuTLS. Impact: potential compromi...

SunGrow iSolarCloud 安全漏洞

SunGrow iSolarCloud is an Android app for new energy power plant management from China SunGrow SunGrow. It is used for power plant data collection, monitoring, operation and maintenance and operation management. A security vulnerability exists in SunGrow iSolarCloud Android app version...

ROS-20250226-16

SSLVERIFYPEER mode vulnerability in the OpenSSL cryptographic library is related to the lack of a mechanism of to notify the user when a communication session is established. Exploitation of the vulnerability could allow an attacker acting remotely to realize a man-in-the-middle attack during a...

CVE-2024-55581

When AdaCore Ada Web Server 25.0.0 is linked with GnuTLS, the default behaviour of AWS.Client is vulnerable to a man-in-the-middle attack because of lack of verification of an HTTPS server's certificate unless the using program specifies a TLS configuration...