BIT-LOGSTASH-2021-22138

In Logstash versions after 6.4.0 and before 6.8.15 and 7.12.0 a TLS certificate validation flaw was found in the monitoring feature. When specifying a trusted server CA certificate Logstash would not properly verify the certificate returned by the monitoring server. This could result in a man in...

BIT-FLINK-2020-1960

A vulnerability in Apache Flink 1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3, 1.9.0 to 1.9.2, 1.10.0 where, when running a process with an enabled JMXReporter, with a port configured via...

BIT-CASSANDRA-2020-13946

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and...

Toyoko Inn official App vulnerable to improper server certificate verification

Overview Toyoko Inn official App provided by Toyoko Inn IT Solution Co., Ltd. is vulnerable to improper server certificate verification CWE-295. Ryo Nihonyanagi of BroadBand Security, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Earl...

Toyoko Inn Security Breach

Toyoko Inn is a hotel chain app by the Japanese company Toyoko Inn. Toyoko Inn has a security vulnerability that stems from. , susceptible to incorrect server certificate validation, which could allow an attacker to conduct a man-in-the-middle attack to eavesdrop on encrypted communications...

Medium: postgresql

Issue Overview: A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. CVE-2021-23222 Affected Packages: postgresql Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit...

Medium: libpq

Issue Overview: A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. CVE-2021-23222 Affected Packages: libpq Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit this...

Advisory ROSA-SA-2024-2366

Software: openssl 1.1.1v OS: ROSA-CHROME packageevrstring: openssl-1.1.1.1v-1.src.rpm CVE-ID: CVE-2023-2650 BDU-ID: 2023-03652 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the OpenSSL library is associated with uncontrolled resource consumption. Exploitation of the vulnerability could allow an...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : libgit2 vulnerabilities (USN-6678-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6678-1 advisory. It was discovered that libgit2 mishandled equivalent filenames on NTFS partitions. If a user or automated...

Amazon Linux 2 : shim (ALAS-2024-2484)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2484 advisory. A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious...

IBM QRadar Suite Certificate Validation Error Vulnerability

IBM QRadar Suite is an integrated security information and event management SIEM solution from International Business Machines IBM that monitors and analyzes network activity in an organization to detect potential security threats. A certificate validation error vulnerability exists in IBM QRadar...

CVE-2023-47742

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 27253...

Code injection

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 27253...

CVE-2023-47742 IBM QRadar Suite information dislosure

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 27253...

IBM QRadar Suite 安全漏洞

IBM QRadar Suite is an integrated security information and event management SIEM solution from International Business Machines IBM that monitors and analyzes network activity in an organization to detect potential security threats. A certificate validation error vulnerability exists in IBM QRadar...

CVE-2023-47742: Improper Certificate Validation

IBM QRadar Suite Products 1.10.12.0 through 1.10.18.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 could disclose sensitive information using man in the middle techniques due to not correctly enforcing all aspects of certificate validation in some circumstances. IBM X-Force ID: 27253...

PT-2024-1988 · Elinksmart · Esmartcam

Name of the Vulnerable Software and Affected Versions: Elink Smart eSmartCam application version 2.1.5 Description: The issue is related to the use of hardcoded AES encryption keys in the application, which can be extracted from a binary file. This allows an attacker who can observe packet data,...

Security Bulletin: IBM QRadar Suite software is vulnerable to information exposure and man in the middle attacks (CVE-2023-47742, CVE-2024-22355)

Summary IBM QRadar Suite software is vulnerable to information exposure through password practices & man in the middle attacks, due to certificate validation issues. This has been updated in the latest release and vulnerabilities have been addressed. Please follow the instructions in the...

Fortinet FortiOS Trust Management Issues Vulnerability (CNVD-2024-13096)

Fortinet FortiOS is a set of U.S. Fita Fortinet dedicated to FortiGate network security platform on the security operating system. A trust management issue vulnerability exists in Fortinet FortiOS that stems from the presence of incorrect certificate validation, which can be exploited by an...

PT-2024-2057 · Ibm · Ibm Qradar Suite Products +1

Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite Products versions 1.10.12.0 through 1.10.18.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue is related to the incorrect enforcement of certificate validation, which could allow an...