CVE-2022-41545

The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 and possibly others authenticates users via basic authentication, with an HTTP header containing a base64 value of the plaintext username and password. Because the web server also does not utilize transpor...

OpenSSH 9.9p1 Denial of Service / Man-In-The-Middle

OpenSSH versions 6.8p1 to 9.9p1 contain a logic error that allow an on-path attacker a.k.a man-in-the-middle to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is off by default. OpenSSH versions 9.5p1 to 9.9p1 are vulnerable to a memory/CPU denial of service relat...

Netgear C7800 安全漏洞

The NETGEAR C7800 is a wireless router from NETGEAR. A security vulnerability exists in the Netgear C7800 that stems from a lack of basic authentication and transport security, which could allow credentials to be stolen via a man-in-the-middle attack...

OpenSSH 9.9p1 Denial of Service / Man-In-The-Middle Vulnerability

OpenSSH versions 6.8p1 to 9.9p1 contain a logic error that allow an on-path attacker a.k.a man-in-the-middle to impersonate any server when the VerifyHostKeyDNS option is enabled. This option is off by default. OpenSSH versions 9.5p1 to 9.9p1 are vulnerable to a memory/CPU denial of service relat...

CVE-2022-41545

Netgear C7800 Router (firmware 6.01.07 and possibly others) exposes admin credentials via basic authentication over HTTP, with credentials base64-encoded in the header and no transport security by default. This enables eavesdropping/MITM on authenticated requests over WLAN or LAN. Reported CVSSv3...

PT-2025-7078

Name of the Vulnerable Software and Affected Versions: Home Assistant Core versions prior to 2024.1.6 Description: The issue concerns a potential man-in-the-middle attack due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

The vulnerability of the SSL_VERIFY_PEER mode in the OpenSSL cryptographic library allows a attacker to execute a man-in-the-middle attack.

The vulnerability of the SSL-VerifyPEER mode in the OpenSSL cryptographic library is related to the absence of a mechanism to notify the user of the establishment of a connection session. Exploiting this vulnerability allows a malicious actor to execute a “man-in-the-middle” attack during a...

Netgear C7800 Missing Transport Encryption

Netgear C7800 suffers from a man-in-the-middle vulnerability...

CVE-2025-1146

CrowdStrike uses industry-standard TLS transport layer security to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where o...

CVE-2023-49250

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle MITM attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which...

The vulnerability of the Veeam Updater, a component of backup and recovery tools such as Veeam Backup for Salesforce, Veeam Backup for Nutanix AHV, and Veeam Backup for AWS, allows a perpetrator to carry out a “man-in-the-middle” attack.

The vulnerability of the Veeam Updater, a component of backup and recovery tools such as Veeam Backup for Salesforce, Veeam Backup for Nutanix AHPV, and Veeam Backup for AWS, relates to access to a channel from a non-endpoint location. Exploiting this vulnerability allows a remote attacker to...

Vulnerability fixed in Veeam

Veeam has fixed a vulnerability in the Veeam Updater component. The vulnerability is in how the Veeam Updater component validates TLS certificates. Insufficient validation can allow Man-in-the-Middle attackers to execute arbitrary code on affected servers. This can lead to unauthorized access and...

Cisco Small Business Series Switches Session Credentials Replay (CVE-2021-34739)

A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated, remote attacker to replay valid user session credentials and gain unauthorized access to the web-based management interface of an affected device. This...

CVE-2025-1146

CrowdStrike uses industry-standard TLS transport layer security to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where o...

CVE-2025-1146 CrowdStrike Falcon Sensor for Linux TLS Issue

CrowdStrike uses industry-standard TLS transport layer security to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where o...

CVE-2025-1146

CVE-2025-1146 affects CrowdStrike Falcon Sensor family for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor. A validation logic error in the TLS connection routine can cause server certificate handling to be processed incorrectly, potentially enabling a man-in-the-middle...

CVE-2025-1193

Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack by presenting a certificate for a different host...

CVE-2024-11621

Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modify encrypted communications via a man-in-the-middle attack. Versions affected are : Remote Desktop Manager macOS 2024.3.9.0 and earlier Remote Desktop Manager...

SUSE CVE-2024-12797

Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSLVERIFYPEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys m...

FreeBSD : OpenSSL -- Man-in-the-Middle vulnerability (a64761a1-e895-11ef-873e-8447094a420f)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a64761a1-e895-11ef-873e-8447094a420f advisory. The OpenSSL project reports: RFC7250 handshakes with unauthenticated servers don't abort as expected...