CVE-2025-0254

CVE-2025-0254 affects HCL Digital Experience components Ring API and dxclient. The vulnerability enables man-in-the-middle (MitM) attacks that could allow an attacker to intercept and potentially alter communications between two parties. Affected versions are prior to 9.5 CF226. The available doc...

CLSA-2025-1742472067 Fix CVE(s): CVE-2025-26465

SECURITY UPDATE: it's possible machine-in-the-middle attack vulnerability caused by a malicious machine impersonating a legitimate server - debian/patches/CVE-2025-26465.patch: Correct error code handling - CVE-2025-26465...

CLSA-2025-1742471910 Fix CVE(s): CVE-2025-26465

SECURITY UPDATE: it's possible machine-in-the-middle attack vulnerability caused by a malicious machine impersonating a legitimate server - debian/patches/CVE-2025-26465.patch: Correct error code handling - CVE-2025-26465...

CVE-2024-10444

Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager DSM before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2024-10444

Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager DSM before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2024-10444

CVE-2024-10444 affects Synology DiskStation Manager (DSM) via the LDAP utilities component, where improper certificate validation enables man-in-the-middle attacks that can hijack administrator authentication. Affected DSM versions include 7.1.1-42962-8, 7.2.1-69057-7, and 7.2.2-72806-3. The issu...

CVE-2024-10444

Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager DSM before 7.1.1-42962-8, 7.2.1-69057-7 and 7.2.2-72806-3 allows man-in-the-middle attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2025-30140

An issue was discovered on G-Net Dashcam BB GONX devices. A Public Domain name is Used for the Internal Domain Name. It uses an unregistered public domain name as an internal domain, creating a security risk. This domain was not owned by GNET originally, allowing an attacker to register it and...

CVE-2025-30132

An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis, it was found that this domain was not owned by IROAD, allowing an attacker to register it and potentially intercept sensitive device...

CVE-2025-30140

CVE-2025-30140 concerns G-Net Dashcam BB GONX devices where an internal domain uses an unregistered public domain name. This creates a risk that an attacker could register that domain and, if the device resolves it publicly, could intercept traffic and enable data exfiltration or a man‑in‑the‑mid...

CVE-2025-30140

An issue was discovered on G-Net Dashcam BB GONX devices. A Public Domain name is Used for the Internal Domain Name. It uses an unregistered public domain name as an internal domain, creating a security risk. This domain was not owned by GNET originally, allowing an attacker to register it and...

PT-2025-11646 · Unknown · G-Net Dashcam Bb Gonx

Name of the Vulnerable Software and Affected Versions: G-Net Dashcam BB GONX devices affected versions not specified Description: The issue concerns the use of an unregistered public domain name as an internal domain, posing a security risk. This allows an attacker to potentially register the...

CVE-2025-30132

CVE-2025-30132 concerns the IROAD Dashcam V series, where an unregistered public domain name was used as an internal domain. This misconfiguration means the domain may not be owned by IROAD, allowing an attacker to register it and potentially intercept sensitive device traffic. If the dashcam or ...

The vulnerability of the Fortinet FortiPortal security analysis and management tool, related to errors in the certificate validation process, allows attackers to execute a type of “man-in-the-middle” attack.

The vulnerability of the Fortinet FortiPortal security analysis and management tool is related to errors in the certificate validation process. Exploiting this vulnerability could allow an attacker to execute a “man-in-the-middle” attack...

CVE-2025-30132

An issue was discovered on IROAD Dashcam V devices. It uses an unregistered public domain name as an internal domain, creating a security risk. During analysis, it was found that this domain was not owned by IROAD, allowing an attacker to register it and potentially intercept sensitive device...

IROAD V Series 安全漏洞

IROAD V Series is a series of car recorders from IROAD. A security vulnerability exists in IROAD V Series that stems from the use of an unregistered public domain name as an internal domain name, which could lead to data exfiltration or man-in-the-middle attacks...

Security Bulletin: AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH

Summary Vulnerabilities in AIX's OpenSSH could allow a remote attacker to cause a denial of service CVE-2025-26466 or a machine-in-the-middle attack CVE-2025-26465. OpenSSH is used by AIX for remote login. Vulnerability Details CVEID:CVE-2025-26466 DESCRIPTION: A flaw was found in the OpenSSH...

Custom vs. Off-the-shelf Educational Software

Educational institutions and businesses looking to implement technology-driven learning solutions often face a key decision: should they invest…...

AIX is vulnerable to a denial of service (CVE-2025-26466) and a machine-in-the-middle attack (CVE-2025-26465) due to OpenSSH

IBM SECURITY ADVISORY First Issued: Mon Mar 17 15:30:45 CDT 2025 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/opensshadvisory18.asc Security Bulletin: AIX is vulnerable to a denial of service CVE-2025-26466 and a machine-in-the-middl...

CVE-2023-48785

An improper certificate validation vulnerability CWE-295 in FortiNAC-F version 7.2.4 and below may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the HTTPS communication channel between the FortiOS device, an inventory, and FortiNAC-F...