CVE-2025-1002

CVE-2025-1002 affects MicroDicom DICOM Viewer 2024.03 and stems from an inadequate verification of the update server’s certificate. The underlying issue could allow an attacker with a privileged network position to perform a man‑in‑the‑middle (MITM) attack, alter the server’s response, and delive...

PT-2025-6043

Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager macOS versions 2024.3.9.0 and earlier Devolutions Remote Desktop Manager Linux versions 2024.3.2.5 and earlier Devolutions Remote Desktop Manager Android versions 2024.3.3.7 and earlier Devolutions Remote...

CVE-2025-1002: Improper Certificate Validation

MicroDicom DICOM Viewer version 2024.03 fails to adequately verify the update server's certificate, which could make it possible for attackers in a privileged network position to alter network traffic and carry out a machine-in-the-middle MITM attack. This allows the attackers to modify the...

hippolyzer (>=0.2.0, <=0.6.3), mitm-chrome (0.1.2) +2 more potentially affected by CVE-2025-23217 via mitmproxy (6.0.2)

mitmproxy PYPI version 6.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - hippolyzer =0.2.0, =0.1.6, =0.11.3 - xepor 0.1.0 Source cves: CVE-2025-23217 Source advisory: OSV:GHSA-WG33-5H85-7Q5P...

badger-proxy (0.1.9), kerberos-auth-proxy (>=0.1.0a3, <=0.1.0a8) +5 more potentially affected by CVE-2025-23217 via mitmproxy (8.1.1)

mitmproxy PYPI version 8.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - badger-proxy 0.1.9 - kerberos-auth-proxy =0.1.0a3, =2.0.1, =0.1.0, =0.4.0, =0.5.0 Source cves: CVE-2025-23217 Source advisory:...

CVE-2024-36553: Channel Accessible by Non-Endpoint

Forever KidsWatch Call Me KW-50 R36YDRA3PWGM7SV1.02019071516.19.24cobh is vulnerable to MITM attack...

CVE-2024-36553

Forever KidsWatch Call Me KW-50 R36YDRA3PWGM7SV1.02019071516.19.24cobh is vulnerable to MITM attack...

CVE-2022-24400

A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero...

CVE-2024-7570

Improper certificate validation in Ivanti ITSM on-prem and Neurons for ITSM Versions 2023.4 and earlier allows a remote attacker in a MITM position to craft a token that would allow access to ITSM as any user...

CVE-2024-49224

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mahesh9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through = 1.0...

CVE-2024-51997

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART Attestation Results Token token, generated by AS, could be manipulated by MITM attacker, but the verifier CoCo Verification Demander like KBS could still verify it successfully. In th...

CVE-2025-23091

An Improper Certificate Validation on UniFi OS devices, with Identity Enterprise configured, could allow a malicious actor to execute a man-in-the-middle MitM attack during application update...

Advisory ROSA-SA-2025-2614

software: yt-dlp 2023.09.24 WASP: ROSA-CHROME packageevrstring: yt-dlp-2023.09.24-1 CVE-ID: CVE-2023-46121 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in yt-dlp allows an attacker to perform a MITM attack and gain access to a cookie. CVE-STATUS: The vulnerability has been resolved...

CVE-2024-50692: Use of Hard-coded Credentials

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT...

CVE-2024-50692

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT...

CVE-2024-50692

SunGrow WiNet-SV200.001.00.P027 and earlier versions contains hardcoded MQTT credentials that allow an attacker to send arbitrary commands to an arbitrary inverter. It is also possible to impersonate the broker, because TLS is not used to identify the real MQTT broker. This means that MQTT...

Airtel Xstream Fiber WiFi Weak Authentication / Brute Force Vulnerability

Exploit Title: Airtel Xstream Fiber WiFi - Usage of Weak Initial WiFi password Exploit Author: Alok kumar email protected, Cyberpwn Technologies Pvt. Ltd. Vendor Homepage: https://www.airtel.in Product Link: https://www.airtel.in/wifi-plans Tested on: Airtel Xstream Fiber WiFi router with SSID...

CVE-2024-51738

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairi...

CVE-2024-51738 Sunshine improperly enforces pairing protocol request order

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairi...

CVE-2024-51738 Sunshine improperly enforces pairing protocol request order

Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and is thereby vulnerable to a MITM attack, potentially allowing an unauthenticated attacker to pair a client by hijacking a legitimate pairi...