Man-in-the-Middle (MitM)

Overview Affected versions of this package are vulnerable to Man-in-the-Middle MitM due to Missing TLS hostname validation. Remediation There is no fixed version for twitter-stream. References - GitHub Security Advisory - GitHub Security Advisory Credit: Agustin Gianni...

DEBIAN-CVE-2020-24392

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

UBUNTU-CVE-2020-24392

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

CVE-2020-24392

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

Design/Logic Flaw

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

CVE-2020-24392

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

CVE-2020-24392

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

CVE-2020-24392

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

CVE-2020-24392

CVE-2020-24392 concerns missing TLS hostname validation in voloko twitter-stream (versions 0.1.10 and 0.1.16 in various advisories), caused by misused eventmachine. This allows a man-in-the-middle attack against users of the library. The vulnerability is described across multiple sources (Red Hat...

PT-2021-11029

Name of the Vulnerable Software and Affected Versions: voloko twitter-stream version 0.1.10 voloko twitter-stream version 0.1.16 Description: The issue is related to missing TLS hostname validation, which allows an attacker to perform a man-in-the-middle attack against users of the library. This ...

Voloko Twitter-stream Trust Management Issues Vulnerability

Laust Rud Jacobsen Voloko Twitter-stream is an application from the individual developer Laust Rud Jacobsen in Denmark. It provides a simple Ruby client library for the Twitter-stream API. A vulnerability exists in Voloko Twitter-stream for trust management issues. The vulnerability stems from th...

CVE-2020-24392: Improper Certificate Validation

In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library because eventmachine is misused...

Misconfigured baby monitors exposing video stream online

By Habiba Rashid A vulnerability in baby monitors due to their misconfiguration could potentially allow dangerous parties to have access to the camera’s video stream. This is a post from HackRead.com Read the original post: Misconfigured baby monitors exposing video stream online...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM DataQuant for Workstation (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM DataQuant for Workstation. The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerability to remotely expose account credentia...

tomcat: Apache Tomcat HTTP/2 Request mix-up

A flaw was found in Apache Tomcat. If an HTTP/2 client exceeded the agreed maximum number of concurrent streams for a connection in violation of the HTTP/2 protocol, it is possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - fro...

tomcat: HTTP/2 request header mix-up

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this...

Microchip MPLAB Net Security Feature Issue Vulnerability

Microchip MPLAB Net is an integrated development environment from Microchip Corporation. A security signature issue vulnerability exists in Microchip MPLAB Net that arises from reversal of publicly available information in an observable output stream...

CVE-2018-21270

A flaw was found in nodejs-stringstream. Node.js stringstream module is vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream...

co.paralleluniverse:galaxy (>=1.1, <=1.2), co.paralleluniverse:quasar-galaxy (0.2.0) +21 more potentially affected by CVE-2021-21290 +1 more via io.netty:netty (3.5.0.final)

io.netty:netty MAVEN version 3.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.netty:netty and may be impacted: - co.paralleluniverse:galaxy =1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.2.3.3,...

PT-2021-11091

Name of the Vulnerable Software and Affected Versions: picoquic versions prior to July 3, 2020 Description: The issue allows attackers to cause a denial of service, resulting in an infinite loop, via a crafted QUIC frame. This is related to the picoquic decode frames and picoquic decode stream...