EUVD-2024-52682

Malicious code in bioql PyPI...

EUVD-2023-35790

Malicious code in bioql PyPI...

EUVD-2022-0408

Malicious code in bioql PyPI...

EUVD-2021-8690

Malicious code in bioql PyPI...

Addressing Weak Authentication like RFID, NFC in EVs and EVCs Using AI-Powered Adaptive Authentication

The rapid expansion of the Electric Vehicles EVs and Electric Vehicle Charging Systems EVCs has introduced new cybersecurity challenges, specifically in authentication protocols that protect vehicles, users, and energy infrastructure. Although widely adopted for convenience, traditional...

CVE-2025-8393 Dreame Technology iOS and Android Mobile Applications Improper Certificate Validation

A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishing TLS communication which may result in man-in-the-middle attacks on untrusted networks. Captured communications may include user credentia...

CVE-2025-54792 LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle MitM vulnerability in the software's discovery protocol allows an unauthenticated attacke...

HCL BigFix Server 10.0.x < 10.0.13 / 11.0.x < 11.0.4 Multiple Vulnerabilities (KB0120585)

The version of HCL BigFix Server installed on the remote host is 10.0.x prior to 10.0.13 or 11.x prior to 11.0.4. It is, therefore, affected by multiple vulnerabilities as referenced in the KB0120585 advisory. - HCL BigFix Web Reports' service communicates over HTTPS but exhibits a weakness in it...

Improper Certificate Validation

couchbasenetclient is vulnerable to improper certificate validation. The vulnerability is due to improper configuration defaults and lack of hostname verification in TLS connections, defaulting to IP addresses instead of hostnames, which allows an attacker to perform man-in-the-middle MitM attack...

CVE-2025-34066

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle MITM attacks...

CVE-2025-34066 AVTECH IP camera, DVR, and NVR Devices Unauthenticated Information Disclosure

An improper certificate validation vulnerability exists in AVTECH IP cameras, DVRs, and NVRs due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This exposes HTTPS communications to man-in-the-middle MITM attacks...

CVE-2025-34066

CVE-2025-34066 affects AVTECH IP cameras, DVRs, and NVRs. The root cause is improper certificate validation caused by using wget with --no-check-certificate in scripts such as SyncCloudAccount.sh and SyncPermit.sh, exposing HTTPS communications to MITM attacks. Affected products are AVTECH device...

PT-2025-27545 · Avtech +1 · Avtech Ip Cameras +3

Name of the Vulnerable Software and Affected Versions: AVTECH IP cameras, DVRs, and NVRs affected versions not specified Description: An improper certificate validation issue exists due to the use of wget with --no-check-certificate in scripts like SyncCloudAccount.sh and SyncPermit.sh. This...

CVE-2025-32880

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and machine-in-the-middle attacks...

CVE-2025-32877

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle...

CVE-2025-32880

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 downloads firmware files via HTTP. However, the communication is not encrypted and allows sniffing and machine-in-the-middle attacks...

CVE-2025-32880

The COROS PACE 3 GPS sports watch, running firmware versions through 3.0808.0 , is vulnerable to sniffing and machine-in-the-middle (MitM) attacks. The root cause is that the device downloads firmware files via unencrypted HTTP when connected to a WLAN. An attacker positioned between the device a...

PT-2025-26322 · Coros · Coros Pace 3

Name of the Vulnerable Software and Affected Versions: COROS PACE 3 versions through 3.0808.0 Description: An issue was discovered that allows the COROS Pace 3 to download firmware files via HTTP when connected to a WLAN, but the communication is not encrypted. This lack of encryption enables...

CVE-2025-32877

An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the use of the Just Works pairing method. This method does not implement any authentication, which therefore allows machine-in-the-middle...

CVE-2025-32877

The COROS PACE 3 GPS sports watch is vulnerable in versions through 3.0808.0 due to a flaw in the Bluetooth pairing method. The device incorrectly identifies itself as having no input or output capabilities, forcing the use of the Just Works pairing method. Because this method lacks authenticatio...