Mozilla: Downgrade attack on SMTP STARTTLS connections

Thunderbird ignored the configuration to require STARTTLS security for an SMTP connection. A MITM could perform a downgrade attack to intercept transmitted messages, or could take control of the authenticated session to execute SMTP commands chosen by the MITM. If an unprotected authentication...

CVE-2021-20375

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

CVE-2021-20375

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

CVE-2021-20375

CVE-2021-20375 affects IBM Sterling File Gateway versions 2.2.0.0 through 6.1.1.0. The issue is improper access controls allowing an authenticated user to intercept and replace a message sent by another user. IBM’s remediation/patch guidance (per IBM Security Bulletin) provides fixes by product v...

IBM Sterling File Gateway 授权问题漏洞

IBM Sterling File Gateway is an application for transferring files between internal and external partners, allowing you to more securely and reliably transfer files with trading partners. IBM Sterling File Gateway versions 2.2.0.0-5.2.6.53, 6.0.0.0-6.0.3.4, 6.1 A data manipulation vulnerability...

CVE-2021-20375

IBM Sterling File Gateway 2.2.0.0 through 6.1.1.0 could allow an authenticated user to intercept and replace a message sent by another user due to improper access controls. IBM X-Force ID: 195567...

Shopify: Disclose STUFF member name and make actions.

Hello Shopify Security Team! Bug Summary: ============= Based on the report 968165, this also can retrieve the STUFF member name and can send messages using his name. Reproduction steps: ============= - install shopify chat applications. Start Exploit 1 : ============= + Go to targeted store : +...

CVE-2020-9062

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting an...

Design/Logic Flaw

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer, allowing an attacker with physical access to internal ATM components to commit deposit forgery by intercepting an...

CVE-2020-13135

D-Link DSP-W215 1.26b03 devices allow information disclosure by intercepting messages on the local network, as demonstrated by a Squid Proxy...

Multiple Huawei Products Data Forgery Issue Vulnerability

The Huawei AR1200, among others, is an enterprise router from Huawei, a Chinese company. A data forgery vulnerability exists in a number of Huawei products. The vulnerability stems from the program failing to adequately verify some fields in a message, which can be exploited by an attacker to cau...

Critical OkCupid Flaw Exposed Daters to App Takeovers

A critical flaw in the OkCupid app has been found that could allow a bad actor to steal credentials, launch man-in-the-middle attacks or completely compromise the victim’s application. This is separate from the OKCupid account-takeover incident reported earlier in the week, but it does fit the...

Reddit Hacked – Emails, Passwords, Private Messages Stolen

Another day, another significant data breach. This time the victim is Reddit... seems someone is really pissed off with Reddit's account ban policy or bias moderators. Reddit social media network today announced that it suffered a security breach in June that exposed some of its users' data,...

CVE-2018-5157

Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR 52.8 an...

Panda Mobile Security for iOS Man-in-the-Middle Attack Vulnerability

Panda Mobile Security for iOS is a mobile antivirus product for iOS developed by the Spanish company Panda Security. The product protects mobile networks from viruses, spyware, hackers and other Internet threats. A security vulnerability exists in version 1.1 of Panda Mobile Security for iOS. An...

Atlassian Hipchat for iOS Man-in-the-Middle Attack Vulnerability

Atlassian Hipchat for iOS is a suite of team chat tools for iOS from the Australian company Atlassian that supports group and 1-to-1 voice and video chat with screen sharing. A security vulnerability exists in Atlassian HipChat for iOS versions prior to 3.16.2. An attacker can exploit the...

5-year-old Skype Backdoor Discovered — Mac OS X Users Urged to Update

Those innocent-looking apps in your smartphone can secretly spy on your communications or could allow hackers to do so. Hard to believe, but it's true. Recently, Trustwave's SpiderLabs analysts discovered a hidden backdoor in Skype for Apple's macOS and Mac OS X operating systems that could be us...

DLA-413-1 gajim - security update

Bulletin has no description...

Gajim Message Interception Vulnerability

Gajim is a suite of free instant messaging software based on the Jabber communication protocol developed by the Gajim project. A security vulnerability exists in versions of Gajim prior to 0.16.5, which can be exploited by remote attackers to modify the roster and intercept messages with the help...

openSUSE Security Update : gajim (openSUSE-2016-29)

This update to gajim 0.16.5 fixes the following security issues : - CVE-2015-8688: Message interception due to unverified origin of roster push - Improve security on connexion and for roster managment boo960668 The following on-security improvements were added : - Improve MAM implementation. -...