CVE-2013-4436

CVE-2013-4436 concerns SaltStack’s salt-ssh default configuration (Salt 0.17.0) that does not validate the SSH host key, enabling MITM-style impact. Multiple connected sources (GHSA-F22J-37JJ-CXW9, OSV, NVD variant) corroborate the MITM risk but do not provide exploit details. A remediation menti...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2013-4436

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

PT-2013-5015

Name of the Vulnerable Software and Affected Versions Salt aka SaltStack version 0.17.0 Description The issue concerns the default configuration of salt-ssh in Salt, which does not validate the SSH host key of requests. This allows remote attackers to potentially conduct a man-in-the-middle MITM...

CVE-2013-4436: Improper Input Validation

The default configuration for salt-ssh in Salt aka SaltStack 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle MITM attack...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

CVE-2012-0825 affects Drupal 6.x up to 6.23 and 7.x up to 7.11, where Attribute Exchange (AX) information is not signed, enabling MITM modification of AX data. Related advisories confirm this CVE in multiple distributions (e.g., Debian DSA-2776-1; MiracleLinux AXSA-2012-98:01). Remediation in aff...

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

CVE-2012-0825

Removed by vendor...

PT-2013-1515

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.22 Drupal versions 7.x through 7.10 Description The issue allows remote attackers to modify potentially sensitive information without detection via a man-in-the-middle MITM attack, as it does not verify that...

Puppet Enterprise < 3.0.1 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise install on the remote host is a version prior to 3.0.1. As a result, it reportedly has multiple vulnerabilities: - An error exists related to the included Ruby SSL client that could allow man-in-the-middle attacks. CVE-2013-4073...

CVE-2012-0825: Exposure of Sensitive Information to an Unauthorized Actor

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle MITM attack...

Updated python-oauth2 packages fix CVE-2013-4347

It was found that in python-oauth2, an application for authorization flows for web applications, the nonce value generated isn't sufficiently random. While doing bulk operations the nonce might be repeated, so there is a chance of predictability. This could allow MITM attackers to conduct replay...

Unbreakable Apple's iMessage encryption is vulnerable to eavesdropping attack

Though Apple claims iMessage has end-to-end encryption, But researchers claimed at a security conference that Apple's iMessage system is not protected and the company can easily access it. Cyril Cattiaux - better known as pod2g, who has developed iOS jailbreak software, said that the company's...

Unbreakable Apple's iMessage encryption is vulnerable to eavesdropping attack

Though Apple claims iMessage has end-to-end encryption, But researchers claimed at a security conference that Apple’s iMessage system is not protected and the company can easily access it. Cyril Cattiaux - better known as pod2g, who has developed iOS jailbreak software, said that the company’s...

Design/Logic Flaw

RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack...

CVE-2012-2125: Undefined Security Weakness

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack...

Cisco Unified Computing System Serial over LAN Static Private Key Vulnerability

A vulnerability in the Cisco Unified Computing System Serial over LAN SoL implementation could allow an unauthenticated, remote attacker to perform a man-in-the-middle MITM attack. The vulnerability occurs because the Board Management Controller BMC uses a hard-coded private key. An attacker coul...

Amazon Linux AMI : perl-libwww-perl (ALAS-2011-17)

The Net::HTTPS module in libwww-perl LWP before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof...