CVE-2024-51997 The Attestation Results Token can be arbitrarily modified without being detected in Trustee

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART Attestation Results Token token, generated by AS, could be manipulated by MITM attacker, but the verifier CoCo Verification Demander like KBS could still verify it successfully. In th...

CVE-2024-51997

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART Attestation Results Token token, generated by AS, could be manipulated by MITM attacker, but the verifier CoCo Verification Demander like KBS could still verify it successfully. In th...

CVE-2024-51997

Trustee (open-source) contains a vulnerability in the Attestation Results Token (ART) where the embedded jwk in the ART payload can be replaced by a MITM attacker, allowing the attacker to sign crafted tokens with their private key. The current code path (v0.8.0) does not detect such replacement,...

CVE-2024-51997 The Attestation Results Token can be arbitrarily modified without being detected in Trustee

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART Attestation Results Token token, generated by AS, could be manipulated by MITM attacker, but the verifier CoCo Verification Demander like KBS could still verify it successfully. In th...

PT-2024-35085

Name of the Vulnerable Software and Affected Versions Trustee versions 0.8.0 through 0.8.1 Description The issue concerns the Attestation Results Token ART token, which can be manipulated by a Man-In-The-Middle MITM attacker. The jwk in the ART token payload can be replaced with the attacker's ow...

CVE-2024-51997: Improper Authentication

Trustee is a set of tools and components for attesting confidential guests and providing secrets to them. The ART Attestation Results Token token, generated by AS, could be manipulated by MITM attacker, but the verifier CoCo Verification Demander like KBS could still verify it successfully. In th...

CVE-2024-40715

A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle MITM attack to exploit this vulnerability...

CVE-2024-40715

A vulnerability in Veeam Backup & Replication Enterprise Manager has been identified, which allows attackers to perform authentication bypass. Attackers must be able to perform Man-in-the-Middle MITM attack to exploit this vulnerability...

CVE-2024-40715

CVE-2024-40715 affects Veeam Backup Enterprise Manager (VBEM) and enables authentication bypass when an attacker can perform a Man-in-the-Middle (MITM) attack. Public writeups in connected documents confirm the vulnerability is tied to VBEM and that exploitation requires MITM conditions. The reme...

IBM Security Verify Access Appliance Insecure Transit / Hardcoded Passwords

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory Information Title: 4 vulnerabilities in ibmsecurity Advisory URL: https://pierrekim.github.io/advisories/2024-ibmsecurity.txt Blog URL: https://pierrekim.github.io/blog/2024-11-01-ibmsecurity-4-vulnerabilities.html Date published: 2024-11-0...

WS-2023-0172

The NATS official Rust clients are vulnerable to MitM when using TLS. A fix for the nats crate hasn't been released yet. Since the nats crate is going to be deprecated anyway, consider switching to async-nats = 0.29 which already fixed this vulnerability. The common name of the server's TLS...

WS-2023-0044

User data in TPM attestation vulnerable to MITM. Attestation user data such as the digest of the public key in an aTLS connection was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an...

CVE-2024-49224

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Mahesh Patel Mitm Bug Tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through 1.0...

CVE-2024-49224

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mahesh9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through = 1.0...

CVE-2024-49224 WordPress Mitm Bug Tracker plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mahesh9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through = 1.0...

CVE-2024-49224 WordPress Mitm Bug Tracker plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mahesh9696 Mitm Bug Tracker mitm-bug-tracker allows Reflected XSS.This issue affects Mitm Bug Tracker: from n/a through = 1.0...

CVE-2024-49224

CVE-2024-49224 is a Reflected XSS in the WordPress plugin Mitm Bug Tracker (versions n/a through 1.0). The vulnerability stems from improper input neutralization during web page generation, enabling reflected script execution. Affected software: Mitm Bug Tracker (WordPress) before or at 1.0. Publ...

CVE-2023-6055

A vulnerability has been identified in Bitdefender Total Security HTTPS scanning functionality where the software fails to properly validate website certificates. Specifically, if a site certificate lacks the "Server Authentication" specification in the Extended Key Usage extension, the product...

CVE-2023-6056

A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of self-signed certificates. The product is found to trust certificates signed with the RIPEMD-160 hashing algorithm without proper validation, allowing an attacker to...

CVE-2023-6057

A vulnerability has been discovered in Bitdefender Total Security HTTPS scanning functionality that results in the improper trust of certificates issued using the DSA signature algorithm. The product does not properly check the certificate chain, allowing an attacker to establish MITM SSL...