Zammad Trust Management Issues Vulnerabilities

Zammad is a suite of ticket management software from the German company Zammad. A trust management issue vulnerability exists in Zammad that stems from the fact that SSL/TLS is used in multiple subsystems to establish connections to external services without properly validating the hostname and...

Spider-Man Developer Insomniac Games Hit by Rhysida Ransomware

By Waqas Another day, another gaming giant claimed by a ransomware group. This is a post from HackRead.com Read the original post: Spider-Man Developer Insomniac Games Hit by Rhysida Ransomware...

Insecure Protocol Handling

github.com/golang/go is vulnerable to Insecure Protocol Handling. The vulnerability exists in the repoRootFromVCSPaths function of vcs.go when using go get to fetch a module with the .git suffix. It may unexpectedly fallback to the insecure git:// protocol if the module is unavailable via the...

The vulnerability of Siemens SCALANCE industrial switches’ SSH server allows a hacker to execute a “man-in-the-middle” attack.

The vulnerability of Siemens SCALANCE industrial switches’ SSH server is related to insufficient encryption strength. Exploiting this vulnerability allows a remote attacker to execute a “man-in-the-middle” attack...

CVE-2023-50454

An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers...

Design/Logic Flaw

An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A trust management issue vulnerability exists in Zammad that stems from the fact that SSL/TLS is used in multiple subsystems to establish connections to external services without properly validating the hostname and...

CVE-2023-50454

An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers...

CVE-2023-50454

An issue was discovered in Zammad before 6.2.0. In several subsystems, SSL/TLS was used to establish connections to external services without proper validation of hostname and certificate authority. This is exploitable by man-in-the-middle attackers...

CVE-2023-50454

Summary: CVE-2023-50454 affects Zammad prior to 6.2.0. In several subsystems, SSL/TLS connections to external services are established without proper validation of hostname and certificate authority, enabling MITM attacks. The issue is documented across multiple feeds (including Red Hat, CNVD, NV...

Security Bulletin: Due to the use of Netty, IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library is vulnerable to a man-in-the-middle attack.

Summary Netty is used by IBM Tivoli Netcool/OMNIbus Transport Module Common Integration Library. CVE-2023-4586 Vulnerability Details CVEID:CVE-2023-4586 DESCRIPTION: Netty is vulnerable to a man-in-the-middle attack, caused by the failure of the Hot Rod client to enable hostname validation when...

hotrod-client: Hot Rod client does not enable hostname validation when using TLS that lead to a MITM attack

A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle MITM attack...

CVE-2023-46219

A security bypass flaw was found in Curl, which can be triggered by saving HSTS data to an excessively long file name. This issue occurs due to an error in handling HSTS long file names, leading to the removal of all contents from the file during the save process, and may allow a remote attacker ...

The vulnerability of the software for centralized device management in Fortinet’s FortiManager and the event monitoring and analysis tool FortiAnalyzer, related to errors in the certificate validation process, allows a perpetrator to carry out a “man-in-the-middle” attack.

The vulnerability of the software for centralized device management in Fortinet’s FortiManager system, as well as the event monitoring and analysis tool FortiAnalyzer, is related to errors in the certificate validation process. Exploiting this vulnerability could allow a malicious actor to carry...

VMware Tools for Linux 10.3.x < 10.3.26 Authentication Bypass (VMSA-2023-0019)

The version of VMware Tools installed on the remote Linux host is 10.3.x prior to 10.3.26. It is, therefore, affected by a SAML token signature bypass vulnerability. A malicious attacker with man-in-the-middle network positioning in the virtual machine network can bypass SAML token signature...

Man-in-the-Middle (MitM)

github.com/edgelesssys/marblerun is vulnerable to Man-in-the-Middle attack. The vulnerability is due to a lack of explicit verification of the coordinator's certificate. This allows an attacker to intercept the communication between the CLI and the Coordinator, providing false information or...

CVE-2023-45840

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the...

CVE-2023-45842

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the mxsldr...

CVE-2023-45841

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the...

CVE-2023-45839

Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622698d7847. A specially crafted man-in-the-middle attack can lead to arbitrary command execution in the builder.This vulnerability is related to the aufs-util...