Farewell to the Fallen: The Cybersecurity Stars We Lost Last Year

It's time once again to pay our respects to the once-famous cybersecurity solutions whose usefulness died in the past year. The cybercriminal world collectively mourns the loss of these solutions and the easy access they provide to victim organizations. These solutions, though celebrated in their...

ABB Cylon Aspect 3.08.02 Cookie User Password Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The application suffers from cleartext transmission and storage of...

PT-2025-1194 · Ibm · Ibm Concert

Name of the Vulnerable Software and Affected Versions: IBM Concert Software versions 1.0.0 through 1.0.3 Description: The issue is related to the failure to properly enable HTTP Strict Transport Security, which could allow a remote attacker to obtain sensitive information using man-in-the-middle...

ABB Cylon Aspect 3.08.02 Cookie User Password Disclosure Vulnerability

ABB Cylon Aspect version 3.08.02 suffers from cleartext transmission and storage of sensitive information in a Cookie. This includes the globals parameter, where authdata contains base64-encoded credentials. A remote attacker can intercept the HTTP Cookie, including authentication credentials,...

PT-2026-1659

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description The libssh software contains a flaw related to a global knownhost override. This issue could potentially allow an attacker to bypass host key verification, potentially leading to...

GHSA-4FWJ-M62Q-PP47 Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Impact A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token is replaced and invalidated upon logout, if an attacker manages to capture the session cookie before...

CVE-2024-56733 Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token ...

CVE-2024-56733 Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token ...

Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Impact A vulnerability has been reported in Password Pusher where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token is replaced and invalidated upon logout, if an attacker manages to capture the session cookie before...

Couchbase 6.x < 7.2.5 / 7.6.x < 7.6.1 Information Disclosure

The version of Couchbase installed on the remote host is 6.x, prior to 7.2.5, and 7.6.x prior to 7.6.1. It is, therefore, affected by an information disclosure issue. It does not ensure that credentials are negotiated with the Key-Value KV service using SCRAM-SHA when remote link encryption is...

The vulnerability of the SAML SSO function of Fortinet’s FortiClient products for Windows, Mac, and iOS lies in authentication process errors, which allow attackers to perform a Mitm attack.

The vulnerability of the SAML SSO function in Fortinet’s FortiClient products for Windows, Mac, and iOS is related to errors in the certificate authentication process. Exploiting this vulnerability can allow an attacker to perform a “man-in-the-middle” attack...

The vulnerability of the Fortinet FortiClient security device, related to errors in the certificate validation process, allows a perpetrator to execute a type of “man-in-the-middle” attack.

The vulnerability of the Fortinet FortiClient security device is related to errors in the certificate validation process. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” attack...

Amazon Linux 2 : libpq (ALASPOSTGRESQL14-2024-015)

The version of libpq installed on the remote host is prior to 14.14-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2POSTGRESQL14-2024-015 advisory. Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different...

TP-LINK WR845N Weak Encryption Vulnerability

The TP-LINK WR845N is a wireless router from China P&L TP-LINK. A weak encryption vulnerability exists in the TP-LINK WR845N version V4190219, which originates from transmitting credentials in base64 encoded form, and can be exploited by an attacker to easily decode them via a man-in-the-middle...

Vulnerability of Veeam Backup & Replication virtual and physical systems, related to incorrect verification of the TLS certificate, allows attackers to execute a “man-in-the-middle” attack.

The vulnerability in Veeam Backup & Replication and physical systems exists due to incorrect verification of the TLS certificate. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

CVE-2024-49820

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man i...

CVE-2024-49820

IBM Security Guardium Key Lifecycle Manager (GKLM) versions 4.1, 4.1.1, 4.2.0, and 4.2.1 are affected by an information-disclosure vulnerability caused by not properly enabling HTTP Strict Transport Security. An attacker could obtain sensitive data via man-in-the-middle attacks. The IBM security ...

CVE-2020-12484

When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead to man-in-the-middle attacks...

CVE-2020-12484

When using special mode to connect to enterprise wifi, certain options are not properly configured and attackers can pretend to be enterprise wifi through a carefully constructed wifi with the same name, which can lead to man-in-the-middle attacks...

CVE-2020-12484

Technical details are not publicly provided in the connected documents. Current records describe a Wi‑Fi impersonation risk but do not list affected products, versions, root cause, indicators, or fixes. Monitor for updates.