Microsoft Bluetooth Driver 安全漏洞

Bluetooth is a popular wireless communication technology. A man-in-the-middle attack vulnerability exists in the Bluetooth Core Specification, which can be exploited by an attacker to compromise session authentication between Bluetooth devices, be able to force a short encryption key length using...

CVE-2023-46445: Insufficient Verification of Data Authenticity

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

CVE-2023-46445

CVE-2023-46445 affects AsyncSSH before 2.14.1, allowing MITM-controlled extension info messages (Rogue Extension Negotiation). IBM Storage Ceph integrations and various Linux distros reference this flaw. Mitigation: upgrade AsyncSSH to 2.14.1 or newer (patching in affected products where applicab...

CVE-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

CVE-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

CVE-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

CVE-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

AsyncSSH Data Forgery Issue Vulnerability

AsyncSSH is a Python package that provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. A data forgery issue vulnerability exists in AsyncSSH v2.14.0 and earlier versions, which stems from a vulnerability that allows an attacker to...

SUSE CVE-2023-46445

An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack, aka a "Rogue Extension Negotiation."...

Rocky Linux 8 : Satellite 6.14 (RLSA-2023:6818)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:6818 advisory. - A flaw was found in all versions of kubeclient up to but not including v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfi...

Rogue Extension Negotiation

asyncssh is vulnerable to Rogue Extension Negotiation. The vulnerability is caused by an implementation flaw in the AsyncSSH server implementation which leads to an injection of an extension info message chosen by the attacker via a man-in-the-middle attack. This is achieved by downgrading the...

The vulnerability of the Identity Manager software component, used for managing and controlling access to corporate resources and IBM Security Verify Governance applications, allows attackers to carry out “man-in-the-middle” attacks.

The vulnerability of the Identity Manager software component, which is used for managing and controlling access to corporate resources and applications in IBM Security Verify Governance, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious...

GHSA-CFC2-WR2V-GXM5 AsyncSSH Rogue Extension Negotiation

Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack. Details The rogue extension negotiation attack targets an AsyncSSH client connecting to any SSH server sending an extension info message. The attack...

AsyncSSH Rogue Extension Negotiation

Summary An issue in AsyncSSH v2.14.0 and earlier allows attackers to control the extension info message RFC 8308 via a man-in-the-middle attack. Details The rogue extension negotiation attack targets an AsyncSSH client connecting to any SSH server sending an extension info message. The attack...

kubeclient: kubeconfig parsing error can lead to MITM attacks

A flaw was found in kubeclient, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate it wrongly returns VERIFYNONE. Ruby applications that leverage...

US Man Sentenced to Over 21 Years for Dark Web Distribution of CSAM

By Waqas You reap what you sow! This is a post from HackRead.com Read the original post: US Man Sentenced to Over 21 Years for Dark Web Distribution of CSAM...

tpm2-tss: Buffer Overlow in TSS2_RC_Decode

A flaw was found in tpm2-tss, which is an open source software implementation of the Trusted Computing Group TCG Trusted Platform Module TPM 2 Software Stack TSS2. In affected versions, Tss2RCSetHandler and Tss2RCDecode index into the layerhandler with an 8-bit layer number, but the array only ha...

PT-2023-35501

Name of the Vulnerable Software and Affected Versions cabal-install versions prior to 3.10.2.0 Description A problem was discovered in cabal-install's implementation of the Hackage Security protocol, which could allow an attacker with a revoked private key and the ability to perform a...

Apache Traffic Server 8.x < 8.1.3 Improper Authentication

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. Note that Nessus did not actually test for these issues, but instead has relied on the version found in the server's banner. %NASLMINLEVEL 80900 C Tenable, Inc...

Rocky Linux 8 : container-tools:rhel8 (RLSA-2020:4694)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4694 advisory. - A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters...