6371 matches found
CVE-2007-5162
The connect method in lib/net/http.rb in the 1 Net::HTTP and 2 Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName CN field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions v...
Cross site request forgery (csrf)
The connect method in lib/net/http.rb in the 1 Net::HTTP and 2 Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName CN field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions v...
Code injection
Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a man-in-the-middle MITM attack...
CVE-2007-3754
Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a man-in-the-middle MITM attack...
CVE-2007-4613
CVE-2007-4613 affects BEA WebLogic Server SSL libraries (versions 6.1 Gold–SP7, 7.0 Gold–SP7, 8.1 Gold–SP5). Vulnerability: an attacker in a MITM can obtain plaintext from an SSL stream by injecting crafted data and measuring timing of error responses. This is a separate issue from CVE-2006-2461....
CVE-2007-3150
Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refresh" that targets a www.google.com search for a local .exe file, which is displayed in the "results...
CVE-2007-3150
CVE-2007-3150 affects Google Desktop. The connected sources describe a user-assisted remote code execution via a man-in-the-middle attack that injects JavaScript, a Google search IFRAME, and a META HTTP-EQUIV="refresh" targeting a local executable. When the compromised link is clicked, Google Des...
CVE-2007-2513
Novell GroupWise 7 before SP2 20070524, and GroupWise 6 before 6.5 post-SP6 20070522, allows remote attackers to obtain credentials via a man-in-the-middle attack...
CVE-2006-7199
CVE-2006-7199 describes a MITM-based exposure in EMC RSA Secur ity SiteKey where a malicious, attacker-controlled proxy can relay authentication data to and from a legitimate SiteKey server, allowing an attacker to cause the correct image to be displayed remotely. The description notes the vendor...
CVE-2007-1558
The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...
CVE-2007-1099
dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks...
CVE-2007-1099
dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch, which might allow remote attackers to conduct man-in-the-middle attacks...
CVE-2007-1099
Dropbear
Code injection
BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle MITM attack...
CVE-2007-0411: Undefined Security Weakness
BEA WebLogic Server 8.1 through 8.1 SP5, 9.0, 9.1, and 9.2 Gold, when WS-Security is used, does not properly validate certificates, which allows remote attackers to conduct a man-in-the-middle MITM attack...
CVE-2006-5867
CVE-2006-5867 affects fetchmail prior to 6.3.6-rc4, where TLS enforcement was inadequate and could transmit cleartext passwords over unsecured links, enabling password disclosure via MITM. Connected advisories confirm updated fetchmail packages with TLS enforcement (e.g., enabling TLS1) to fix th...
CVE-2006-6477: Undefined Security Weakness
FRAgent.exe in Mandiant First Response MFR before 1.1.1, when run in daemon mode and configured to use only HTTP, allows local users to modify requests and responses between a client and an agent by hijacking an HTTP FRAgent daemon and conducting a man-in-the-middle MITM attack...
Mozilla Thunderbird: Multiple vulnerabilities
Background Mozilla Thunderbird is a popular open-source email client from the Mozilla Project. Description It has been identified that Mozilla Thunderbird improperly handles Script objects while they are being executed, allowing them to be modified during execution. JavaScript is disabled in...
VMSA-2006-0010 - SSL sessions not authenticated by VC Clients
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - - ------------------------------------------------------------------- VMware Security Advisory Advisory ID: VMSA-2006-0010 Synopsis: SSL sessions not authenticated by VC Clients Patch URL:http://www.vmware.com/download/vi/vc-201-200611-patch.html...