Synology DiskStation Manager Cleartext Transmission of Sensitive Information (CVE-2020-27656)

Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager DSM before 6.2.3-25426-2 allows man- in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors. This plugin only works with Tenable.ot. Please visit...

CVE-2024-46548

TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sensitive information via a man-in-the-middle attack...

CVE-2024-46548

TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sensitive information via a man-in-the-middle attack...

CVE-2024-46548

TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communications and access sensitive information via a man-in-the-middle attack...

CVE-2024-46548

CVE-2024-46548 affects TP-Link Tapo P125M and Kasa KP125M (v1.0.3). The root cause is improper validation of certificates, which can allow a remote attacker to perform a man‑in‑the‑middle attack to eavesdrop on communications and access sensitive information. Connected sources corroborate the imp...

TP-LINK Kasa KP125M和TP-LINK Tapo P125M 安全漏洞

TP-LINK Kasa KP125M and TP-LINK Tapo P125M are both a smart plug from China P&L TP-LINK. A security vulnerability exists in TP-LINK Kasa KP125M v1.0.3 and TP-LINK Tapo P125M v1.0.2, which stems from incorrect validation of certificates, and can be exploited by an attacker to eavesdrop on...

Checkmk Exchange plugin MikroTik 安全漏洞

Checkmk Exchange plugin MikroTik is a plugin from Checkmk Inc. A security vulnerability exists in Checkmk Exchange plugin MikroTik versions 2.0.0 through 2.5.5 and 0.4amk through 2.0a, which originates from improper certificate validation and allows an attacker in the position of MitM to intercep...

PT-2024-6815 · Unknown · Zangi Private Messenger

Name of the Vulnerable Software and Affected Versions: Zangi Private Messenger affected versions not specified Description: The issue is related to weaknesses in the session key generation mechanism of the application. This could allow a remote attacker to implement a "man-in-the-middle" attack...

DEBIAN-CVE-2024-47174

Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle MITM...

UBUNTU-CVE-2024-47174

Nix is a package manager for Linux and other Unix systems. Starting in version 1.11 and prior to versions 2.18.8 and 2.24.8, did not verify TLS certificates on HTTPS connections. This could lead to connection details such as full URLs or credentials leaking in case of a man-in-the-middle MITM...

CVE-2024-47174

CVE-2024-47174 affects Nix’s fetchurl/builtin:fetchurl in versions 1.11 through before 2.18.8 and 2.24.8, where TLS certificates were not verified on HTTPS, risking leakage of full URLs and credentials (e.g., from netrc) under MITM. TOFU-style hash misupdates could also be abused. Affected compon...

CVE-2023-52950

Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors...

CVE-2023-52950

CVE-2023-52950 affects Synology Active Backup for Business Agent’s login component. The root cause is missing encryption of sensitive data, enabling adjacent (local) attackers to perform MITM-style credential exposure via unspecified vectors. Impact is confined to confidentiality loss of user cre...

CVE-2023-52950

Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors...

CVE-2023-52950

Missing encryption of sensitive data vulnerability in login component in Synology Active Backup for Business Agent before 2.7.0-3221 allows adjacent man-in-the-middle attackers to obtain user credential via unspecified vectors...

Synology Active Backup for Business Agent 安全漏洞

Synology Active Backup for Business Agent is a backup program from China-based Synology Inc. A security vulnerability exists in Synology Active Backup for Business Agent prior to version 2.7.0-3221, which stems from a lack of sensitive data encryption vulnerability in the login component, allowin...

Nix 授权问题漏洞

Nix is a powerful package manager from the Nix open source. It is used for making packages. An authorization issue vulnerability exists in Nix from version 1.11 until version 2.24.8, which stems from the fact that nix/fetchurl.nix does not validate TLS certificates on HTTPS requests, resulting in...

CVE-2024-20350

A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability...

CVE-2024-20350 Cisco Catalyst Center Static SSH Host Key Vulnerability

A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability...

PT-2024-6439 · Cisco · Cisco Catalyst Center

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst Center versions affected versions not specified Description: A vulnerability in the SSH server could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This issue is due to the presence ...