PT-2024-10915 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.3.5 Liferay DXP 7.3 before fix pack 1 Liferay DXP 7.2 before fix pack 17 Description: The issue allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder...

PT-2025-2395 · Apache · Apache Cassandra

Name of the Vulnerable Software and Affected Versions: Apache Cassandra versions 4.0.2 through 5.0.2 Description: A local attacker without access to the Apache Cassandra process or configuration files can manipulate the RMI registry to perform a man-in-the-middle attack. This allows the attacker ...

PKIX-SSH Prefix Truncation Attacks in SSH Specification (Terrapin Attack)

PKIX-SSH is vulnerable to a novel prefix truncation attack a.k.a. Terrapin attack. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

submissions.thenation.com Cross Site Scripting vulnerability OBB-3854412

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GLSA-202402-16 : Apache Log4j: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202402-16 Apache Log4j: Multiple Vulnerabilities - Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with ...

Security Bulletin: IBM Observability with Instana is affected by Multiple Security Vulnerabilities

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana build 265 Vulnerability Details CVEID:CVE-2023-34062 DESCRIPTION: VMware Tanzu Reactor Netty could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An...

Security Bulletin: IBM Sterling Connect:Direct Web Services is vulnerable to man-in-the-middle attack due to Hot Rod (CVE-2023-4586)

Summary IBM Sterling Connect:Direct Web Services uses Hot Rod. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-4586 DESCRIPTION: Hot Rod client is vulnerable to a man-in-the-middle attack, caused by the failure to enable hostname...

CVE-2024-23674

The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim's identify for access to government, medical, and financial resources, and can also extract personal data from...

Authentication flaw

The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim's identify for access to government, medical, and financial resources, and can also extract personal data from...

CVE-2023-47537

An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel...

Input validation

An improper certificate validation vulnerability in Fortinet FortiOS 7.0.0 - 7.0.13, 7.2.0 - 7.2.6 and 7.4.0 - 7.4.1 allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel between the FortiOS device and FortiSwitch...

CVE-2023-47537

An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel...

CVE-2023-47537

Fortinet FortiOS contains an improper certificate validation vulnerability (CVE-2023-47537) enabling remote unauthenticated MITM on the FortiLink channel between FortiOS and FortiSwitch. Affected: FortiOS 7.4.0–7.4.1, 7.2.0–7.2.6, 7.0.0–7.0.15, and 6.4 all versions. Impact: Confidentiality/Integr...

CVE-2023-47537

An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.15, FortiOS 6.4 all versions allows a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the FortiLink communication channel...

CVE-2024-23674

The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. A man-in-the-middle attacker can assume a victim's identify for access to government, medical, and financial resources, and can also extract personal data from...

PT-2024-20011 · Unknown · Online-Ausweis-Funktion Eid

Name of the Vulnerable Software and Affected Versions: Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 Description: The issue allows authentication bypass by spoofing, enabling a man-in-the-middle attacker to assume a victim's identity and access...

CVE-2023-6408

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack...

Design/Logic Flaw

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack...

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: I’m speaking at the Munich Security Conference MSC 2024 in Munich, Germany, on Friday, February 16, 2024. I’m giving a keynote on “AI and Trust” at Generative AI, Free Speech, & Public Discourse. The symposium will be held at...

CVE-2023-6408

Summary (CVE-2023-6408) : The vulnerability is in Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert, and Modicon M340/M580 PLCs, caused by improper enforcement of message integrity during transmission in a communication channel . This enables a Man-in-the-Middle attack tha...