1355 matches found
Dell Customer Connect 1.3.28.0 Privilege Escalation Vulnerability
Exploit for windows platform in category local exploits Exploit Dell Customer Connect 1.3.28.0 Privilege Escalation Date: 25.04.2017 Software Link: http://www.dell.com/ Exploit Author: Kacper Szurek Contact: https://twitter.com/KacperSzurek Website: https://security.szurek.pl/ Category: local 1...
Man-in-the-Middle (MitM)
ansible is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists because it does not perform ample validation of HTTPS certificate using geturl and uri modules. Therefore, it fails to catch the mismatch between server hostname and a domain name in the subject's Common Name CN or...
CVE-2016-8273
Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...
Hardcoded credentials
Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...
CVE-2016-8273
Huawei HiSuite PC client (version 4.0.5.300_OVE) is vulnerable due to using insecure HTTP to download upgrade packages and not validating package integrity. This allows a local attacker to conduct a man‑in‑the‑middle attack to interrupt or replace the downloaded software, potentially compromising...
CVE-2016-8273
Huawei PC client software HiSuite 4.0.5.300OVE uses insecure HTTP for upgrade software package download and does not check the integrity of the software package before installing; an attacker can launch an MITM attack to interrupt or replace the downloaded software package and further compromise...
CVE-2017-2448
An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. The issue involves the "Keychain" component. It allows man-in-the-middle attackers to bypass an iCloud Keychain secret protection mechanism by leveraging...
New Relic: SSL Padding Oracle On Downgraded Legacy Encryption (POODLE) Vulnerability
Hi, I get in touch to report that cloud.newrelic.com is vulnerable to CVE-2014-3566 POODLE. Websites that support SSLv3 and CBC-mode ciphers are potentially vulnerable to an active MITM Man-in-the-middle attack. This attack, called POODLE, is similar to the BEAST attack and also allows a network...
CVE-2016-4927
Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle MITM type of attacks while a Space device is communicating with managed devices...
CVE-2016-4927
Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle MITM type of attacks while a Space device is communicating with managed devices...
CVE-2016-4927
Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle MITM type of attacks while a Space device is communicating with managed devices...
CVE-2016-8495
An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...
Input validation
An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle MITM attack via the Fortisandbox devices probing feature...
Man-in-the-Middle (MitM)
flink-mesos is susceptible to man-in-the-middle attacks. The attack is possible because it does not use canonical hostname verification in SSL validation for client-to-server connections...
Nextcloud: HTTP-Basic Authentication on logs.nextcloud.com
Greetings, While visiting https://logs.nextcloud.com/ , I noticed that this server use HTTP-Basic Authentication. F152730 POC : ------ GET https://logs.nextcloud.com/ HTTP/1.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.11; rv:50.0 Gecko/20100101 Firefox/50.0 Accept:...
Explained — What's Up With the WhatsApp 'Backdoor' Story?
What is a backdoor? By definition: "Backdoor is a feature or defect of a computer system that allows surreptitious unauthorized access to data, " either the backdoor is in encryption algorithm, a server or in an implementation, and doesn't matter whether it has previously been used or not...
CVE-2016-10138
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute t...
Design/Logic Flaw
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute t...
CVE-2016-10138
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. The com.adups.fota.sysoper app is installed as a system app and cannot be disabled by the user. In the com.adups.fota.sysoper app's AndroidManifest.xml file, it sets the android:sharedUserId attribute t...