PT-2025-49833

A vulnerability has been identified in COMOS V10.6 All versions, COMOS V10.6 All versions, JT Bi-Directional Translator for STEP All versions, NX V2412 All versions V2412.8900 with Cloud Entitlement bundled as NX X, NX V2506 All versions V2506.6000 with Cloud Entitlement bundled as NX X, Simcente...

Siemens SINEMA Remote Connect Server 安全漏洞

Siemens SINEMA Remote Connect Server is a remote network management platform from Siemens Germany. The platform is primarily used to remotely access, maintain, control and diagnose the underlying network. A security vulnerability exists in Siemens SINEMA Remote Connect Server versions prior to V3...

NETGEAR多款产品 安全漏洞

NETGEAR Nighthawk is a series of wireless routers from NETGEAR. A security vulnerability exists in various NETGEAR products that stems from improper input validation for the speedtest feature, which could allow an attacker to use man-in-the-middle techniques to manipulate DNS responses and execut...

Siemens IAM Client

SUMMARY Multiple Siemens products are affected by improper certificate validation in IAM Client. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens is preparing fix versions and recommends countermeasures for products where fixes are not, or not yet...

CVE-2025-40801: Improper Certificate Validation

A vulnerability has been identified in COMOS V10.6 All versions V10.6.1, COMOS V10.6 All versions V10.6.1, JT Bi-Directional Translator for STEP All versions, NX V2412 All versions V2412.8900 with Cloud Entitlement bundled as NX X, NX V2506 All versions V2506.6000 with Cloud Entitlement bundled a...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to inverted logic in the InsecureSkipVerify field when processing the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. An attacker can intercept and read sensitive data by performing...

PT-2025-49685

Name of the Vulnerable Software and Affected Versions Traefik versions 3.5.0 through 3.6.2 Description Traefik is an HTTP reverse proxy and load balancer. A flaw exists in the TLS verification logic within the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. When this annotation is set to...

traefik -- Inverted TLS Verification Logic in Kubernetes NGINX Provider

The traefik project reports: There is a potential vulnerability in Traefik NGINX provider managing the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. The provider inverts the semantics of the nginx.ingress.kubernetes.io/proxy-ssl-verify annotation. Setting the annotation to "on" intendi...

PT-2026-2517

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the Open vSwitch component related to insufficient validation of attributes in the push nsh action. Specifically, the code does not adequately...

Exploit for CVE-2025-41744

Lab: CVE-2025-41744 - Use of Default Cryptographic Key in Spre...

Attackers have a new way to slip past MFA in educational orgs

Researchers are warning about a rise in cases of attackers using Evilginx to steal session cookies among educational institutions—letting them bypass the need for a multi-factor authentication MFA token. Evilginx is an attacker-in-the-middle phishing toolkit that sits between you and the real...

CLSA-2025-1764772736 libnbd: Fix of CVE-2024-7383

CVE-2024-7383: verify NBD server's certificate to prevent man-in-the-middle attack on NBD traffic...

ROS-20251203-18

Vulnerability of the cURL server communication software tool is related to errors in the host verification mechanism when using the wolfSSH-based backend. host verification mechanism when using wolfSSH-based backend. Exploitation of the vulnerability could allow an attacker acting remotely to...

ROS-20251203-03

A vulnerability in the JMX interface of the Apache Cassandra distributed database management system is related to a flaw in the deserialization mechanism. flaws in the deserialization mechanism. Exploitation of the vulnerability could allow an attacker to implement a man-in-the-middle...

ROS-20251203-19

Vulnerability in the Ruby programming language library that implements the MQTT protocol Rubygem MQTT is related to the lack of hostname validation. Exploitation of the vulnerability could allow A remote attacker to perform a man-in-the-middle attack...

CVE-2024-32384

Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device...

PT-2025-48465

Name of the Vulnerable Software and Affected Versions Kerlink gateways versions prior to 5.10 Description Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, lacking HTTPS support. This absence of transport layer security enables a...

The vulnerability of Siemens Solid Edge’s design and modeling tools, related to errors in the authentication process, allows a perpetrator to carry out a “man-in-the-middle” attack.

The vulnerability of Siemens Solid Edge’s design and simulation tools is related to errors in the authentication process for certificates. Exploiting this vulnerability could allow a malicious actor to carry out a “man-in-the-middle” attack...

CVE-2024-32384

Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device...

CVE-2024-32384: Cleartext Transmission of Sensitive Information

Kerlink gateways running KerOS prior to version 5.10 expose their web interface exclusively over HTTP, without HTTPS support. This lack of transport layer security allows a man-in-the-middle attacker to intercept and modify traffic between the client and the device...