Westermo WeOS Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2015-7547)

An attacker that successfully masquerade as an upstream DNS server may serve the WeOS device with malicious DNS query response that can allow the attacker full unauthorized access to the device. The glibc DNS client side resolver is vulnerable to a stack-based buffer overflow when the getaddrinfo...

Westermo WeOS Cryptographic Issues (CVE-2015-7923)

Westermo WeOS before 4.19.0 uses the same SSL private key across different customers' installations, which makes it easier for man-in- the-middle attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a key. This plugin only works with Tenable.ot. Please visit...

openSUSE 15: python3-python-qpid-proton / qpid-proton-devel / etc (SUSE-SU-2024:1074-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:1074-1 advisory. - CVE-2019-0223: Fixed TLS Man in the Middle Vulnerability bsc1133158. Tenable has extracted the preceding description block directly from the SUSE security...

Inadequate Encryption Strength

Cilium is vulnerable to Inadequate Encryption Strength. The vulnerability is due to an ESP sequence number collision when multiple nodes are configured with the same key, leading to chosen plaintext, key recovery, and replay attacks by a man-in-the-middle attacker...

Serverpod client accepts any certificate

This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic an...

GHSA-H6X7-R5RG-X5FW Serverpod client accepts any certificate

This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic an...

CVE-2023-45706

An administrative user of WebReports may perform a Cross Site Scripting XSS and/or Man in the Middle MITM exploit through SAML configuration...

CVE-2023-45706 HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack

An administrative user of WebReports may perform a Cross Site Scripting XSS and/or Man in the Middle MITM exploit through SAML configuration...

CVE-2023-45706

CVE-2023-45706 affects WebReports/HCL BigFix Platform where an administrative user can trigger a Cross Site Scripting (XSS) and/or a Man in the Middle (MITM) attack via SAML configuration. The connected sources corroborate that the issue involves WebReports and SAML configuration enabling XSS/MIT...

CVE-2023-45706 HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack

An administrative user of WebReports may perform a Cross Site Scripting XSS and/or Man in the Middle MITM exploit through SAML configuration...

Serverpod client accepts any certificate

This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device and the server. An attacker would need to be able to intercept the traffic an...

HCL BigFix Platform 安全漏洞

HCL Technologies HCL BigFix Platform is a suite of endpoint security management platforms from HCL Technologies, USA. The platform supports automated discovery, management and remediation of endpoint security issues. A security vulnerability exists in the HCL BigFix Platform that originates from ...

PT-2024-13272 · Unknown · Webreports

Name of the Vulnerable Software and Affected Versions: WebReports affected versions not specified Description: The issue allows an administrative user of WebReports to perform a Cross Site Scripting XSS and/or Man in the Middle MITM exploit through SAML configuration. Recommendations: At the...

CVE-2024-29887

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-28860

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...

CVE-2024-29887 Serverpod client accepts any certificate

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-29887 Serverpod client accepts any certificate

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-29887 Serverpod client accepts any certificate

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-28860

CVE-2024-28860 affects Cilium’s IPsec transparent encryption. The issue arises from an ESP sequence number collision when multiple nodes share a key, enabling a MITM attacker to perform chosen-plaintext, key-recovery, and replay attacks that can undermine confidentiality and integrity. Fixed in C...

CVE-2024-28860 Insecure IPsec transport encryption in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Users of IPsec transparent encryption in Cilium may be vulnerable to cryptographic attacks that render the transparent encryption ineffective. In particular, Cilium is vulnerable to chosen plaintext, key...