CVE-2025-48825

RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-in-the-middle attack to eavesdrop upgrade requests and execute a malicious DLL with custom code...

CVE-2025-48825

RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-in-the-middle attack to eavesdrop upgrade requests and execute a malicious DLL with custom code...

CVE-2025-48825

RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-in-the-middle attack to eavesdrop upgrade requests and execute a malicious DLL with custom code...

CVE-2025-48825

The CVE-2025-48825 affects Ricoh Streamline NX V3 PC Client, versions 3.5.0–3.7.0. The issue is use of a less trusted source, enabling a local-MITM attacker to eavesdrop upgrade requests and execute a malicious DLL with custom code. Impact is limited to scenarios where an attacker can position th...

PT-2025-25402 · Ricoh · Ricoh Streamline Nx V3 Pc Client

Name of the Vulnerable Software and Affected Versions: RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 Description: The issue is related to the use of a less trusted source, which may allow an attacker to conduct a man-in-the-middle attack, eavesdrop on upgrade requests, and execute a...

JVN#27937557: Multiple vulnerabilities in RICOH Streamline NX PC Client

RICOH Streamline NX PC Client provided by Ricoh Company, Ltd. contains multiple vulnerabilities listed below. External control of file name or path CWE-73 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N Base Score 6.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Base Score 6.5...

B&R Automation Runtime Use of a Cryptographic Primitive with a Risky Implementation (CVE-2024-0323)

The FTP server used on the B&R Automation Runtime supports unsecure encryption mechanisms, such as SSLv3, TLSv1.0 and TLS1.1. An network- based attacker can exploit the flaws to conduct man-in-the-middle attacks or to decrypt communications between the affected product clients. This plugin only...

CVE-2024-7457

The ws.stash.app.mac.daemon.helper tool contains a vulnerability caused by an incorrect use of macOS’s authorization model. Instead of validating the client's authorization reference, the helper invokes AuthorizationCopyRights using its own privileged context root, effectively authorizing itself...

CVE-2025-49146

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required default value is prefer, the driver would incorrectly allow connections to proceed with authentication methods that do not support...

pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

Impact When the PostgreSQL JDBC driver is configured with channel binding set to required default value is prefer, the driver would incorrectly allow connections to proceed with authentication methods that do not support channel binding such as password, MD5, GSS, or SSPI authentication. This cou...

CVE-2025-49146

CVE-2025-49146 affects the PostgreSQL JDBC driver (pgjdbc). From 42.7.4 through 42.7.7, when channel binding is set to required, connections could proceed using non-SASL authentication methods (e.g., password, MD5, GSS, SSPI), enabling MITM interception. The issue is fixed in 42.7.7. Affected con...

CVE-2025-49146 pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to required default value is prefer, the driver would incorrectly allow connections to proceed with authentication methods that do not support...

Cisco Nexus Dashboard Fabric Controller Trust Management Issues Vulnerability

The Cisco Nexus Dashboard Fabric Controller is a comprehensive network management platform from Cisco for managing Cisco NX-OS deployments for LAN, SAN, and IP Fabric for Media IPFM networks in data centers. A trust management issue vulnerability exists in Cisco Nexus Dashboard Fabric Controller...

EulerOS 2.0 SP13 : openssh (EulerOS-SA-2025-1622)

According to the versions of the openssh packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious...

CVE-2024-7457

The CVE-2024-7457 entry concerns ws.stash.app.mac.daemon.helper on macOS. Affected component is the ws.stash.app.mac.daemon.helper, which improperly uses macOS AuthorizationCopyRights() with its own privileged context (root) instead of validating the client’s authorization reference. This allows ...

NewStart CGSL MAIN 7.02 : openssh Vulnerability (NS-SA-2025-0089)

The remote NewStart CGSL host, running version MAIN 7.02, has openssh packages installed that are affected by a vulnerability: - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a...

CVE-2025-20163

A vulnerability in the SSH implementation of Cisco Nexus Dashboard Fabric Controller NDFC could allow an unauthenticated, remote attacker to impersonate Cisco NDFC-managed devices. This vulnerability is due to insufficient SSH host key validation. An attacker could exploit this vulnerability by...

Nintendo: Man-in-the-middle through broken SSL certificate verification

The vulnerability allowed for man-in-the-middle attacks through broken SSL certificate verification...

AlmaLinux 9 : openssh (ALSA-2025:6993)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:6993 advisory. openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled CVE-2025-26465 Tenable has extracted the preceding description block directly from the AlmaLin...

RHEL 9 : openssh (RHSA-2025:3837)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3837 advisory. OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary f...