Man-in-the-Middle (MitM)

systemd:sid is vulneranble to Man-in-the-Middle MitM. The vulnerability due to systemd-resolved accept records of DNSSEC-signed domains. It allows an attacker to manipulate records with out any signature...

PT-2023-31761 · Tenda · Tenda M3

Name of the Vulnerable Software and Affected Versions: Tenda M3 version 1.0.0.124856 Description: A stack overflow issue was discovered via the function formGetWeiXinConfig. Recommendations: For Tenda M3 version 1.0.0.124856, as a temporary workaround, consider disabling the formGetWeiXinConfig...

British LAPSUS$ Teen Members Sentenced for High-Profile Attacks

Two British teens part of the LAPSUS$ cyber crime and extortion gang have been sentenced for their roles in orchestrating a string of high-profile attacks against a number of companies. Arion Kurtaj, an 18-year-old from Oxford, has been sentenced to an indefinite hospital order due to his intent ...

DEBIAN-CVE-2023-7008

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles or the upstream DNS resolver to manipulate records...

Design/Logic Flaw

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles or the upstream DNS resolver to manipulate records...

CVE-2023-7008

A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles or the upstream DNS resolver to manipulate records...

GHSA-HWCC-4CV8-CF3H Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

Issue Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List CRL were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between...

Snowflake Connector .NET does not properly check the Certificate Revocation List (CRL)

Issue Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List CRL were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between...

Webinar recap: Ransomware gangs and Living Off The Land attacks (LOTL)

Discover the intersection of Ransomware-as-a-Service RaaS gangs and Living Off The Land LOTL attacks in our latest webinar, now available on-demand, led by cybersecurity experts Ian Thomas, Mark Stockley, and Bill Cozens. The webinar revealed how RaaS gangs use LOTL tactics, leveraging legitimate...

GitHub Enterprise Server Log Information Disclosure Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. Provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A log information disclosure vulnerability exists in GitHub Enterprise Server versions prior t...

CVE-2023-50703

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

CVE-2023-50703

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

CVE-2023-50703

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

Information disclosure

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

Prefix Truncation Attacks in SSH Specification (Terrapin Attack)

The remote SSH server is supporting an specific encryption algorithm or MAC. Parts of their SSH specification are vulnerable to a novel prefix truncation attack a.k.a. Terrapin attack. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, a...

WordPress The Events Calendar Plugin < 6.2.8.1 Information Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:tri:theeventscalendar"; if description...

CVE-2023-50703 Cleartext Transmission of Sensitive Information in EFACEC UC 500E

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

CVE-2023-50703 Cleartext Transmission of Sensitive Information in EFACEC UC 500E

An attacker with network access could perform a man-in-the-middle MitM attack and capture sensitive information to gain unauthorized access to the application...

CVE-2023-50703

CVE-2023-50703 affects EFACEC UC 500E (HMI) and relates to cleartext transmission of sensitive information. Public sources in connected documents identify UC 500E version 10.1.0 as affected and note that an attacker with network access can perform a MitM attack to capture sensitive data and gain ...

CVE-2023-43870

When installing the Net2 software a root certificate is installed into the trusted store. A potential hacker could access the installer batch file or reverse engineer the source code to gain access to the root certificate password. Using the root certificate and password they could then create...