Offchain resolver can be subject to man in the middle attacks

Lines of code Vulnerability details Description Calls to the offchain resolver are produced by the code below: function resolve bytes calldata name, bytes calldata data external view returns bytes memory string memory urls = new string; urls0 = gatewayURL; revert OffchainLookup addressthis, urls,...

Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs

Summary Multiple vulnerabilities were fixed in IBM Cloud Pak for Watson AIOps version 3.7.1 Vulnerability Details CVEID:CVE-2023-0767 DESCRIPTION: Mozilla Network Security Services NSS, as used in Mozilla Firefox, could allow a remote attacker to execute arbitrary code on the system, caused by an...

The vulnerability of the Kerberos protocol for Windows operating systems allows a perpetrator to carry out a “man-in-the-middle” attack and increase their privileges.

The vulnerability of the Kerberos protocol for Windows operating systems is related to the insecure use of the RC4 encryption algorithm with a MD4 hash function. Exploiting this vulnerability could allow an attacker to carry out a “man-in-the-middle” attack and increase their privileges...

Improper Certificate Validation

bigflow is vulnerable to Improper Certificate Validation. The vulnerability due to improper SSL certificate validation in the getvaulttoken function which allows an attacker to preform a Man-in-the-Middle attack...

Siemens SCALANCE X-200IRT Devices Inadequate Encryption Strength (CVE-2023-29054)

A vulnerability has been identified in SCALANCE X200-4P IRT All versions V5.5.2, SCALANCE X201-3P IRT All versions V5.5.2, SCALANCE X201-3P IRT PRO All versions V5.5.2, SCALANCE X202-2IRT All versions V5.5.2, SCALANCE X202-2IRT All versions V5.5.2, SCALANCE X202-2P IRT All versions V5.5.2, SCALAN...

SUSE SLES15 / openSUSE 15 Security Update : libgit2 (SUSE-SU-2023:1909-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:1909-1 advisory. - CVE-2023-22742: Fixed SSH keys verification failure bsc1207364. Tenable has extracted the preceding description block directly from the...

PT-2023-3597

Name of the Vulnerable Software and Affected Versions HTTP::Tiny versions prior to 0.083 Description The issue is related to errors in the TLS certificate authentication procedure, allowing a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The...

AIX (IJ45224)

The version of AIX installed on the remote host is prior to APAR IJ45224. It is, therefore, affected by a vulnerability as referenced in the IJ45224 advisory. - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify tha...

AIX (IJ44987)

The version of AIX installed on the remote host is prior to APAR IJ44987. It is, therefore, affected by a vulnerability as referenced in the IJ44987 advisory. - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify tha...

AIX (IJ45221)

The version of AIX installed on the remote host is prior to APAR IJ45221. It is, therefore, affected by a vulnerability as referenced in the IJ45221 advisory. - Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify tha...

Fortinet Fortigate Lack of certificate verification when establishing secure connections with threat feed fabric connectors (FG-IR-22-257)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-22-257 advisory. - An improper certificate validation vulnerability CWE-295 in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.7, 6.4 all...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

Xxe

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

CVE-2022-38840

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

PT-2023-13658 · Güralp · Güralp Man-Eam-0003

Name of the Vulnerable Software and Affected Versions: Güralp MAN-EAM-0003 version 3.2.4 Description: The issue is related to an XML External Entity XXE problem via XML file upload, which can lead to local file disclosure. This occurs in the cgi-bin/xmlstatus.cgi component. Recommendations: For...

CVE-2022-38840: Improper Restriction of XML External Entity Reference

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure...

Siemens SIMATIC IPC DiagMonitor Trust Management Issue Vulnerability

Siemens SIMATIC IPC DiagMonitor is a set of system monitoring and troubleshooting software from Siemens Germany. A trust management issue vulnerability exists in Siemens SIMATIC IPC DiagMonitor, which can be exploited by an attacker to perform a man-in-the-middle attack to modify data in transit...

CVE-2022-38840

The Güralp MAN-EAM-0003 3.2.4 system is affected by an XML External Entity (XXE) vulnerability in the cgi-bin/xmlstatus.cgi endpoint. An XML file upload can trigger local file disclosure, enabling an unauthenticated attacker to read files on the seismic monitoring system. A fix is to upgrade to a...

Security Bulletin: IBM BladeCenter Advanced Management Module is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0221, CVE-2014-0195, CVE-2014-0198, CVE-2010-5298, and CVE-2014-3470.

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Content Vulnerability...