Updated owncloud-client package fixes security vulnerability

ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...

MGASA-2015-0256 Updated owncloud-client package fixes security vulnerability

ownCloud Desktop Client before 1.8.2 was vulnerable against MITM attacks when used in combination with self-signed certificates CVE-2015-4456. The owncloud-client package has been updated to version 1.8.3, which fixes this issue as well as several other bugs...

MiTo Xiu Xiu, the gReader, the Foxit PDF reader in the column: 1 4, of Android apps vulnerable to MiTM attacks-vulnerability warning-the black bar safety net

! AppBugs company researchers through the analysis found that there are 1 4 Total Total Download amount up to 8 million times the popular APP in processing social account login when there is a security risk, vulnerable to MiTM hijacking（MITM attack is. Problem application list MeituPic MiTo Xiu...

LG Handsets' App Update Doesn't Verify SSL Cert, Could Lead to Hijacking

Many smartphones manufactured by LG contain a vulnerability that can allow an attacker to replace an APK file with a malicious file of his choice. The problem is the result of several conditions on LG phones. Like other manufacturers, LG includes custom apps on its handsets, which are not availab...

McAfee ePolicy Orchestrator Man-in-the-Middle Attack Vulnerability (Jun 2015)

McAfee ePolicy Orchestrator is prone to a man-in-the-middle MITM vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2016-3478

Name of the Vulnerable Software and Affected Versions Python versions prior to 2.7.9 Python versions 3.x prior to 3.3.3 Description The issue arises from improper handling of wildcards in hostnames by the ssl.match hostname function, potentially allowing man-in-the-middle attackers to spoof serve...

Samsung Flaw Lets Hacker Easily Take Control of Your Galaxy Mobile Remotely

More than 600 Million users of Samsung Galaxy smartphones, including the newly released Galaxy S6, are potentially vulnerable to a software bug that allows hackers to secretly monitor the phone's camera and microphone, read text messages and install malicious apps. The vulnerability is due to a...

AIX 7.1 TL 2 : nettcp (IV73418) (POODLE)

A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 2...

AIX 7.1 TL 3 : nettcp (IV73316) (POODLE)

A man-in-the-middle MitM information disclosure vulnerability, known as POODLE, exists due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. A MitM attacker can decrypt a selected byte of a cipher text in as few as 2...

This POODLE Bites: Exploiting The SSL 3.0 Fallback

Introduction SSL 3.0 RFC6101 is an obsolete and insecure protocol. While for most practical purposes it has been replaced by its successors TLS 1.0 RFC2246, TLS 1.1 RFC4346, and TLS 1.2 RFC5246, many TLS implementations remain backwards­compatible with SSL 3.0 to interoperate with legacy systems ...

Desktop Client: Improper validation of certificates when using self-signed certificates

The ownCloud Desktop Client was vulnerable against MITM attacks until version 1.8.2 in combination with self-signed certificates. To be exploitable the following conditions have to be met: The connection to the remote ownCloud server must be secured using a self-signed certificate which the user...

Improper validation of certificates when using self-signed certificates - ownCloud

The ownCloud Desktop Client was vulnerable against MITM attacks until version 1.8.2 in combination with self-signed certificates. To be exploitable the following conditions have to be met: The connection to the remote ownCloud server must be secured using a self-signed certificate which the user...

Thycotic Password Manager Secret Server iOS Application - MITM SSL Certificate Vulnerability

Thycotic Password Manager Secret Server iOS Application - MITM SSL Certificate Vulnerability -- http://www.info-sec.ca/advisories/Thycotic-SecretServer.html Overview "With the Password Manager Secret Server app, you can access passwords for an EXISTING on-premise Secret Server or Secret Server...

Internet Bug Bounty: Flash Player information disclosure (etc.) CVE-2015-3044, PSIRT-3298

The vulnerability allows a malicious Flash app on a website to read and write Local Shared Objects belonging to any website. As a special case, LSO's of macromedia.com contain global Flash settings. Overwriting them allows e.g. unlimited access to camera and microphone of the target user. Other...

LogJam — This New Encryption Glitch Puts Internet Users at Risk

After HeartBleed, POODLE and FREAK encryption flaws, a new encryption attack has been emerged over the Internet that allows attackers to read and modify the sensitive data passing through encrypted connections, potentially affecting hundreds of thousands of HTTPS-protected sites, mail servers, an...

Certificate trust vulnerability in Websense Content Gateway

SUMMARY Websense Content Gateway proxy explicitly trusts compromised certificate authorities Affected versions: Content Gateway 7.8.x Not affected: Content Gateway 7.7.x, 8.0 DESCRIPTION Websense Content Gateway is a filtering web proxy and content inspection application based on a modified...

MySQL 5.1.x < 5.7.3 SSL/TLS Downgrade MitM (BACKRONYM)

The remote host has a version of the MySQL client library installed that is 5.1.x, 5.5.x, 5.6.x, or 5.7.x prior to 5.7.3. It is, therefore, affected by a security feature bypass vulnerability known as 'BACKRONYM' due to a failure to properly enforce the requirement of an SSL/TLS connection when t...

Updated async-http-client packages fix security vulnerabilities

Updated async-http-client packages fix security vulnerabilities: It was found that async-http-client would disable SSL/TLS certificate verification under certain conditions, for example if HTTPS communication also uses client certificates. This can be exploited by a Man-in-the-middle MITM attack...

MySQL SSL/TLS connection there is a security vulnerability, by the man in the middle attacks-vulnerability warning-the black bar safety net

Due to the client in the connection to MySQL when the SSL options are used improperly, may cause middle attack. The vulnerability will cause the database to the communication data in plaintext form in the network transmission. Vulnerability details This vulnerability with the client”–ssl”option h...

VMware vCenter Server Multiple Java Vulnerabilities (VMSA-2015-0003) (POODLE)

The VMware vCenter Server installed on the remote host is version 5.0 prior to 5.0u3d, 5.1 prior to 5.1u3a, 5.5 prior to 5.5u2e, or 6.0 prior to 6.0.0a. It is, therefore, affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE, related to the bundled JRE componen...