CVE-2019-3462

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...

CVE-2019-3462

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...

Man-in-the-Middle (MitM)

apache-airflow is vulnerable to man-in-the-middle MitM attack. A misconfiguration and improper exceptions checking in the LDAP authentication backend airflow.contrib.auth.backends.ldapauth disabled server certificate checking, and allowed for man-in-the-middle attacks against clients connecting t...

CVE-2019-3462: apt/apt-get remote code execution vulnerability alerts-a vulnerability alert-the black bar safety net

0x00 vulnerability background 2019 1 May 22, @Max Justicz in his blog is disclosed about the debian-based package Manager apt/apt-get remote code execution in some detail. When by APT for any software installation, update, etc., the default will be to go HTTP instead of HTTPS, an attacker can MiT...

CVE-2019-3462

Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine...

CVE-2018-18908

The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle MiTM attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the...

CVE-2018-18908

The CVE-2018-18908 entry concerns Sky Go Desktop for Windows (version 1.0.19-1 to 1.0.23-1). According to the NVD/NVD-linked records, the affected application makes several requests over cleartext HTTP, exposing submitted data to potential MiTM attackers. Some requests may carry sensitive informa...

CVE-2018-18908

The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle MiTM attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the...

Code injection

Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by...

Man-in-the-Middle (MitM)

python27-python is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as the HTTP clients in the 1 httplib, 2 urllib, 3 urllib2, and 4 xmlrpclib libraries in CPython aka Python 2.x before 2.7.9 and 3.x before 3.4.3, when accessing an HTTPS URL, do not a check the certificate...

Man-in-the-Middle (MitM)

gnutls is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is 1 not yet...

Man In The Middle (MitM) Attacks Are Possible With Spoofed SSL Servers

Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or...

Man In The Middle (MitM) Attacks Are Possible With Spoofed SSL Servers

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

Preverify_ok Value Incorrectly Checked

python-glanceclient is vulnerable to man-in-the-middle MitM attacks. This vulnerability is due to the fact that the preverifyok value is not correctly checked. This prevents the hostname from being validated with a domain name in the Common Name or SubjectAltName field of the X.509 certificate,...

Man-in-the-Middle (MitM)

Ruby is vulnerable to man-in-the-middle attack. The SSL client's hostname identity check does not properly handle certificates with hostnames containing NULL bytes. A remote attacker, who has obtained a specific certificate that is signed by an trusted CA, is able to exploit the vulnerability to...

Man In The Middle (MitM) Attacks Are Possible With Spoofed SSL Servers

The Apache Commons HTTPClient 3.x as used in Amazon Flexible Payments Service FPS merchant Java SDK and other SDK products, does not verify that the server hostname matches a domain name in the subjects Common Name CN or subjectAltName field of the X.509 certificate, which allows Man In The Middl...

Man-in-the-Middle (MitM)

python is vulnerable to man-in-the-middle MitM attacks. The vulnerability exists as the ssl.matchhostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a \0 character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows...

CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server or Man-in-The-Middle attacker can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. Mitigation This issue only affects the user...

CVE-2018-20685

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. Mitigation This issue only affects the users of scp binary which...

CVE-2018-5481

CVE-2018-5481 affects OnCommand Unified Manager for 7-Mode (core package) prior to version 5.2.4, where cookies are set without the secure attribute in certain circumstances. This can enable impersonation via MITM attacks on network-accessible sessions. The vulnerability arises from cookie securi...