CVE-2024-13990 MicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of Updates

MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle MitM attack and substitute malicious update...

CVE-2024-13990

The MicroWorld eScan AV security software contains a vulnerability where the update mechanism fails to perform robust cryptographic verification to ensure the authenticity and integrity of update packages. This flaw allows an on-path attacker to conduct a man-in-the-middle (MitM) attack, substitu...

CVE-2025-34199 Vasion Print (formerly PrinterLogic) Insecure SSL Verification Allows Man-in-the-Middle Attacks

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 VA and SaaS deployments contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal...

CVE-2025-34199 Vasion Print (formerly PrinterLogic) Insecure SSL Verification Allows Man-in-the-Middle Attacks

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 VA and SaaS deployments contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal...

CVE-2025-34199

Vasion Print Virtual Appliance Host (pre-22.0.1049) and Vasion Print Application (pre-20.0.2786) expose insecure TLS usage due to disabling verification. Specifically, the code disables CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER and uses environment variables (e.g., API_*_VERIFYSSL=false) ...

CVE-2025-34199

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 VA and SaaS deployments contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal...

CVE-2025-34198

CVE-2025-34198 affects Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application where versions before 22.0.951 (Host) and 20.0.2368 (Application) include shared, hardcoded SSH host private keys (RSA, ECDSA, ED25519) embedded in the appliance image. Because the same keys are use...

PT-2025-38597

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.951 Vasion Print formerly PrinterLogic Application versions prior to 20.0.2368 Description Vasion Print formerly PrinterLogic Virtual Appliance Host and Applicati...

CVE-2024-13990: Improper Certificate Validation

MicroWorld eScan AV's update mechanism failed to ensure authenticity and integrity of updates: update packages were delivered and accepted without robust cryptographic verification. As a result, an on-path attacker could perform a man-in-the-middle MitM attack and substitute malicious update...

CVE-2025-34199: Improper Certificate Validation

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.1049 and Application versions prior to 20.0.2786 VA and SaaS deployments contain insecure defaults and code patterns that disable TLS/SSL certificate verification for communications to printers and internal...

CVE-2025-34198: Use of Hard-coded Credentials

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.951 and Application prior to 20.0.2368 VA and SaaS deployments contain shared, hardcoded SSH host private keys in the appliance image. The same private host keys RSA, ECDSA, and ED25519 are present across...

MicroWorld eScan AV 安全漏洞

MicroWorld eScan AV is a security software for protection against malware from MicroWorld India. A security vulnerability exists in MicroWorld eScan AV that stems from a failure of the update mechanism to ensure the authenticity and integrity of update packages, which could lead to...

PT-2025-38604

Name of the Vulnerable Software and Affected Versions MicroWorld eScan AV affected versions not specified Description The update mechanism in MicroWorld eScan AV lacked proper cryptographic verification of update packages. This allowed an attacker to perform a man-in-the-middle MitM attack and...

Vasion Print Virtual Appliance Host和Vasion Print Application 安全漏洞

Vasion Print Virtual Appliance Host and Vasion Print Application are both products of Vasion Corporation of the U.S.A. Vasion Print Virtual Appliance Host is a print management software.Vasion Print Application is a printer management application. A security vulnerability exists in Vasion Print...

PT-2025-38598

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 22.0.1049 Vasion Print formerly PrinterLogic Application versions prior to 20.0.2786 Description Vasion Print formerly PrinterLogic Virtual Appliance Host and...

Vasion Print Virtual Appliance Host和Vasion Print Application 信任管理问题漏洞

Vasion Print Virtual Appliance Host and Vasion Print Application are both products of Vasion Corporation of the U.S.A. Vasion Print Virtual Appliance Host is a print management software.Vasion Print Application is a printer management application. A trust management issue vulnerability exists in...

CVE-2025-9708

A vulnerability exists in the Kubernetes C client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority CA without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially...

Kubernetes Trust Management Issues Vulnerabilities

Kubernetes K8s is an open source system of Kubernetes open source for automating the deployment, scaling, and management of containerized applications. Kubernetes suffers from a trust management issue vulnerability that stems from the certificate validation logic not properly validating the chain...

SUSE CVE-2025-9708

A vulnerability exists in the Kubernetes C client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority CA without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially...

Missing Encryption of Sensitive Data

Overview Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data via the DownloadTinyFile function. An attacker can intercept and modify file downloads by performing a man-in-the-middle attack on network traffic, potentially causing peers to receive malicious file...