Serverpod client accepts any certificate

This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic an...

PT-2024-13272 · Unknown · Webreports

Name of the Vulnerable Software and Affected Versions: WebReports affected versions not specified Description: The issue allows an administrative user of WebReports to perform a Cross Site Scripting XSS and/or Man in the Middle MITM exploit through SAML configuration. Recommendations: At the...

CVE-2024-29887

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-28860

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...

CVE-2024-29887 Serverpod client accepts any certificate

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-29887 Serverpod client accepts any certificate

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-29887 Serverpod client accepts any certificate

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-28860 Insecure IPsec transport encryption in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...

CVE-2024-28860

CVE-2024-28860 affects Cilium’s IPsec transparent encryption. The issue arises from an ESP sequence number collision when multiple nodes share a key, enabling a MITM attacker to perform chosen-plaintext, key-recovery, and replay attacks that can undermine confidentiality and integrity. Fixed in C...

CVE-2024-28860 Insecure IPsec transport encryption in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...

Serverpod 安全漏洞

Serverpod is a web server from Serverpod open source. A security vulnerability exists in versions of Serverpod prior to 1.2.6 that stems from a vulnerability that allows an attacker to bypass the validation of TSL certificates on all non-web HTTP clients in the serverpodclient package, resulting ...

PT-2024-23110

Name of the Vulnerable Software and Affected Versions Serverpod versions prior to 1.2.6 Description The issue bypasses the validation of TSL certificates on all non-web HTTP clients in the serverpod client package, making them susceptible to a man-in-the-middle attack against encrypted traffic...

PT-2024-22610

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.13.13 Cilium versions prior to 1.14.9 Cilium versions prior to 1.15.3 Description: Cilium, a networking, observability, and security solution with an eBPF-based dataplane, has a vulnerability in its IPsec transparen...

osbuild-composer < 94 Race Condition

The version of osbuild-composer installed on the remote host is prior to 94. It may, therefore, be affected by a race condition. A condition can be triggered that disables GPG verification for package repositories, which can expose the build phase to a Man-in-the-Middle attack, allowing untrusted...

PT-2024-22905 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Humble Hawksbill versions 2 Description: An issue in ROS2 allows attackers to obtain sensitive information via man-in-the-middle attacks due to cleartext transmission of data across the ROS2 nodes' communication channels. Recommendations...

PT-2024-22564 · Solaredge · Mysolaredge

Name of the Vulnerable Software and Affected Versions: SolarEdge mySolarEdge application version prior to 2.20.1 for Android Description: The issue is related to a certificate verification problem, allowing a Machine-in-the-middle MitM attacker to read and alter all network traffic between the...

PT-2024-22902 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 Humble Hawksbill versions 2 Description: An issue was discovered where the system transmits messages in plaintext, allowing attackers to access sensitive information via a man-in-the-middle attack. Recommendation...

CVE-2023-35888

IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Forc...

CVE-2023-35888 IBM Security Verify Governance information disclosure

IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Forc...

PT-2024-12520 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0.2 Description: The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle techniques. Th...