open-iscsi: open-iscsi: Privilege Escalation via Path Traversal

A flaw was found in open-iscsi. This vulnerability, known as Path Traversal, allows remote Man-in-the-Middle MITM attackers to manipulate file paths. By doing so, attackers can create files with root privileges outside the intended database and inject malicious content into system records. This...

NetRaptor

NetRaptor - ARP-Spoofing-MITM-Tool NetRaptor ist ein GUI-basiertes ARP-Spoofing-Tool, entwickelt in Python, das es ermöglicht, ein Netzwerk zu scannen, ein Ziel und ein Gateway auszuwählen und einen Man-in-the-Middle MITM-Angriff durchzuführen. Dieses Tool ist ausschließlich für Bildungszwecke un...

mysslstrip

mysslstrip mysslstrip è un proof of concept basato su Python che mostra come intercettare il traffico MySQL e rimuovere SSL/TLS, come da CVE-2015-3152. Utilizzo mysslstrip.py -h -p LISTENPORT -i LISTENINTERFACE dest Esempio di output root@kitploit: root@duo1 python2.7 mysslstrip.py -p 3307...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

pyrdp

PyRDP PyRDP ist ein Python-basiertes Remote Desktop Protocol RDP Monster-in-the-Middle MITM-Tool und eine Bibliothek. Es bietet einige Werkzeuge: RDP Monster-in-the-Middle Protokolliert verwendete Klartext-Anmeldedaten oder NetNTLM-Hashes beim Verbinden Stiehlt Daten, die in die Zwischenablage...

iron-proxy

iron-proxy Das Problem CI-Jobs, KI-Codierungsagenten und sandboxed Container können beliebige ausgehende Anfragen stellen. Eine kompromittierte Abhängigkeit, eine Prompt-Injection oder ein bösartiger Build- Schritt kann Geheimnisse exfiltrieren, sich nach Hause telefonieren oder eine Reverse Shel...

CVE-2026-81034

Netmaker (through v1.6.0 ) unconditionally disables TLS certificate verification on its SMTP connection in pro/email/smtp.go , where the skip-verify field is set to true with no configuration path to override it. An attacker positioned between Netmaker and its mail relay can present a rogue certi...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

CVE-2026-54548 kas: Persistent SSH Host Key Checking Disablement

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates /.ssh/config when no user-specific SSH configuration exists and adds a global Host rule containing StrictHostKeyChecking no. In kas/libcmds.py,...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

open-isns: open-iscsi: Denial of Service via double-free in iSNS attribute decoder

A flaw was found in open-iscsi. An unauthenticated man-in-the-middle MITM attacker can exploit a double-free vulnerability in the iSNS attribute decoder. This can lead to a denial of service DoS condition, making the affected system unavailable...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by improper SSL/TLS certificate validation vulnerability in JWT service component

Summary IBM Integrated Analytics System includes JWT service as an internal component responsible for JSON Web Token authentication. A security issue was detected in the apjwtservice.py module where SSL/TLS server certificate validation is not enabled on an SSL/TLS connection. The absence of...

Moxy

Moxy Moxy Next-Gen Man-in-the-Middle-Proxy Open-Source-DAST-Tool für Pentesting, unterstützt durch agentische KI-Fähigkeiten unterstützt Ollama. Basierend auf browser-use optimiert Moxy das dynamische Anwendungssicherheitstesten. 🚀 UNGLAUBLICH EINFACH ZU BEDIENEN Und es ist kostenlos – wer mag...

fortios-ldap-mitm-poc-CVE-2019-5591

CVE-2019-5591 Questo Proof of Concept PoC dimostra un attacco MITM Man-In-The-Middle: impersonificazione di un server LDAP sulla sottorete locale di un dispositivo FortiGate che esegue una versione vulnerabile di FortiOS. Versioni interessate Queste versioni sono vulnerabili:...

nginx: NGINX: Heap buffer over-read allows memory modification or denial of service

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...

CVE-2026-79785

X-AnyLabeling's model downloader disabled TLS certificate verification by calling ssl._create_unverified_context() in download_with_retry (within anylabeling/services/auto_labeling/model.py), so neither the certificate chain nor hostname was validated when fetching models over HTTPS. An attacker ...

EUVD-2026-65595

X-AnyLabeling's model downloader disabled TLS certificate verification. downloadwithretry in anylabeling/services/autolabeling/model.py built a context with ssl.createunverifiedcontext and passed it to urllib.request.urlopen, so neither the certificate chain nor the hostname was checked on any...

nginx: NGINX: Heap buffer over-read allows memory modification or denial of service

A vulnerability in NGINX's ngxhttpssimodule allows an unauthenticated MITM attacker to trigger a heap buffer over-read by manipulating upstream server responses. This requires SSI, proxypass, and proxybuffering off to be configured, and can result in memory modification or a Denial of Service DoS...