MacPaw Way The Unarchiver 安全漏洞

MacPaw Way The Unarchiver is a free decompression software from MacPaw Way that supports many common and older compression formats. A security vulnerability exists in MacPaw Way The Unarchiver version 6.4.0, which originated from a vulnerability that allows an attacker to inject arbitrary code vi...

7-Zip Mark-of-the-Web Bypass Vulnerability (Jan 2025) - Windows

7zip is prone to a mark-of-the-web bypass vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:7-zip:7-zip";...

CVE-2019-12986

creationtimestamp| type| source ---|---|--- 2025-01-21 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-21 2025-01-26 00:00:00+00:00| seen| The Shadowserver honeypot/common-vulnerabilities - 2025-01-26 2025-01-30 00:00:00+00:00| seen| The Shadowserver...

7-Zip Mark-of-the-Web Bypass Vulnerability

This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

PT-2025-1927 · WordPress · The Picture Gallery – Frontend Image Uploads

Name of the Vulnerable Software and Affected Versions: The Picture Gallery – Frontend Image Uploads, AJAX Photo List plugin for WordPress versions up to, and including, 1.5.22 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escapi...

New 'Sneaky 2FA' Phishing Kit Targets Microsoft 365 Accounts with 2FA Code Bypass

Cybersecurity researchers have detailed a new adversary-in-the-middle AitM phishing kit that's capable of Microsoft 365 accounts with an aim to steal credentials and two-factor authentication 2FA codes since at least October 2024. The nascent phishing kit has been dubbed Sneaky 2FA by French...

CVE-2024-12399

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication...

CVE-2024-12399

The CVE-2024-12399 entry concerns Schneider Electric Pro-face GP‑Pro EX and Remote HMI. The underlying issue is improper enforcement of message integrity during transmission in a communication channel, which could enable a man‑in‑the‑middle attack and lead to partial loss of confidentiality, inte...

CVE-2024-12399

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication...

PT-2025-5302 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: visionOS versions prior to 2.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 macOS Sequoia versions prior to 15.3 watchOS versions prior to 11.3 tvOS versions prior to 18.3 Description: A type confusion issue was addressed with...

WordPress The Loops plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin The Loops versions = 1.0.2...

Man-in-the-middle(MitM) Attack

github.com/notaryproject/notation-go is vulnerable to Man-in-The-Middle attack. The vulnerability is due to the failure to verify the revocation status of the certificate chain during timestamp signature generation, allowing attackers to exploit compromised or revoked certificates to generate...

CVE-2024-10970

The The Motors – Car Dealer, Classifieds & Listing plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.4.43. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

The vulnerability of theOTP library set in the Erlang programming language allows attackers to carry out “man-in-the-middle” type attacks.

The vulnerability of theOTP library in the Erlang programming language is related to errors in the authentication process for certificates. Exploiting this vulnerability allows attackers who operate remotely to carry out “man-in-the-middle” type attacks...

CVE-2024-48121

The HI-SCAN 6040i Hitrax HX-03-19-I was discovered to transmit user credentials in cleartext over the GIOP protocol. This allows attackers to possibly gain access to sensitive information via a man-in-the-middle attack...

CVE-2025-0500

An issue in the native clients for Amazon WorkSpaces when running Amazon DCV protocol, Amazon AppStream 2.0, and Amazon DCV Clients may allow an attacker to access remote sessions via man-in-the-middle...

CVE-2025-0501

An issue in the native clients for Amazon WorkSpaces when running PCoIP protocol may allow an attacker to access remote sessions via man-in-the-middle...

CVE-2025-0501 Issue affecting Amazon WorkSpaces Clients (when running PCoIP protocol)

An issue in the native clients for Amazon WorkSpaces when running PCoIP protocol may allow an attacker to access remote sessions via man-in-the-middle...

CVE-2025-0501

CVE-2025-0501 affects the native Amazon WorkSpaces clients (PCoIP) and is described as allowing an attacker to access remote sessions via man‑in‑the‑middle, due to a trust management issue (as noted by multiple sources). The issue is associated with high impact across confidentiality, integrity, ...

CVE-2025-0500

CVE-2025-0500 describes a man-in-the-middle vulnerability in the native clients for Amazon WorkSpaces (DCV), Amazon AppStream 2.0, and Amazon DCV clients that could allow an attacker to access remote sessions. Connected sources enumerate concrete vulnerable components/versions: Amazon AppStream 2...