Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products

(scope

change).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

low privilege infrastructure logon
infrastructure logon privilege
unauthorized ability to crash
denial of service
dos


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Oracle

Solaris

attacks

may

significantly

impact

additional

products

(scope

change).

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H).


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability in the Oracle VM Server for Sparc component of Oracle Sun Systems Products Suite (subcomponent: LDOM Manager). Supported versions that are affected are 3.2 and 3.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM Server for Sparc executes to compromise Oracle VM Server for Sparc. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM Server for Sparc attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM Server for Sparc. CVSS v3.0 Base Score 5.9 (Availability impacts).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

Prior

to

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

VM

VirtualBox

accessible

data

and

unauthorized

read

access

to

a

subset

of

Oracle

VM

VirtualBox

accessible

data.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H).


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Smartcard

Libraries).

The

supported

version

that

is

affected

is

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Solaris

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Solaris

accessible

data

and

unauthorized

read

access

to

a

subset

of

Solaris

accessible

data.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H).


Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: VirtualBox SVGA Emulation). Supported versions that are affected are VirtualBox prior to 5.0.32 and prior to 5.1.14. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized creation deletion or modification access to critical data or all Oracle VM VirtualBox accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS v3.0 Base Score 8.4 (Integrity and Availability impacts).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Shared

Folder).

Supported

versions

that

are

affected

are

Prior

to

and

Prior

to

Easily

\exploitable\

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

VM

VirtualBox

accessible

data

and

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H).


Vulnerability

in

the

Oracle

Hospitality

Cruise

Materials

Management

component

of

Oracle

Hospitality

Applications

(subcomponent:

MMSUpdater).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Hospitality

Cruise

Materials

Management

executes

to

compromise

Oracle

Hospitality

Cruise

Materials

Management.

While

the

vulnerability

is

in

Oracle

Hospitality

Cruise

Materials

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Hospitality

Cruise

Materials

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Hospitality

Cruise

Materials

Management

accessible

data

and

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Hospitality

Cruise

Materials

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

VM

VirtualBox

accessible

data.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H).


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Filesystem).

The

supported

version

that

is

affected

is

AK

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Sun

ZFS

Storage

Appliance

Kit

(AK)

executes

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Sun

ZFS

Storage

Appliance

Kit

(AK).

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

VM

VirtualBox

accessible

data

and

unauthorized

read

access

to

a

subset

of

Oracle

VM

VirtualBox

accessible

data.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Cluster

component

of

Oracle

MySQL

(subcomponent:

Cluster:

ndbcluster/plugin).

Supported

versions

that

are

affected

are

and

prior

and

prior

and

prior

and

and

prior.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

MySQL

Cluster

executes

to

compromise

MySQL

Cluster.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

MySQL

Cluster.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Solaris

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Kernel).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Solaris

executes

to

compromise

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

The

supported

version

that

is

affected

is

Prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Filesystem).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

Supported

versions

that

are

affected

are

Prior

to

prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H).


Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

Supported

versions

that

are

affected

are

Prior

to

prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H).


Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

Supported

versions

that

are

affected

are

Prior

to

prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Kernel).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

Solaris

product

of

Oracle

Systems

(component:

Filesystem).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

Solaris

executes

to

compromise

Oracle

Solaris.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Solaris

accessible

data

and

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

Solaris.

CVSS

Base

Score

(Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).


Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Enterprise

Manager

Ops

Center

component

of

Oracle

Enterprise

Manager

Products

Suite

(subcomponent:

Networking).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Enterprise

Manager

Ops

Center.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Enterprise

Manager

Ops

Center

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Optimizer).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).


Vulnerability

in

the

Oracle

Managed

File

Transfer

component

of

Oracle

Fusion

Middleware

(subcomponent:

MFT

Runtime

Server).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Managed

File

Transfer.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Managed

File

Transfer

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Oracle

Managed

File

Transfer

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N).


Vulnerability

in

the

PeopleSoft

Enterprise

PT

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

RemoteCall).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PT

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

PeopleSoft

Enterprise

PT

PeopleTools

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Create

Session

privilege

with

network

access

via

OracleNet

to

compromise

Core

RDBMS.

While

the

vulnerability

is

in

Core

RDBMS

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Core

RDBMS

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N).


Vulnerability

in

the

Oracle

FLEXCUBE

Direct

Banking

product

of

Oracle

Financial

Services

Applications

(component:

eMail).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

low

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

FLEXCUBE

Direct

Banking.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

FLEXCUBE

Direct

Banking

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).


Vulnerability

in

the

Oracle

ODBC

Driver

component

of

Oracle

Database

Server<span

class=font-red><b>

***PRIVILEGE

CANNOT

BE

FOR

AUTHENTICATED

ATTACKS***.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

low

privileged

attacker

having

privilege

with

network

access

via

multiple

protocols

to

compromise

Oracle

ODBC

Driver.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

ODBC

Driver.

Note:

The

vulnerability

affects

Windows

platforms

only.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

Hospitality

Simphony

component

of

Oracle

Food

and

Beverage

Applications.

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

low

privileged

attacker

having

Import/Export

privilege

with

network

access

via

HTTP

to

compromise

Oracle

Hospitality

Simphony.

While

the

vulnerability

is

in

Oracle

Hospitality

Simphony

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hospitality

Simphony

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).


The mail message display page in SquirrelMail through 1.4.22 has XSS via a \<math><maction xlink:href=\ attack.


The mail message display page in SquirrelMail through 1.4.22 has XSS via a \<math xlink:href=\ attack.


The mail message display page in SquirrelMail through 1.4.22 has XSS via a \<form action='data:text\ attack.


The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).


The mail message display page in SquirrelMail through 1.4.22 has XSS via a \<svg><a xlink:href=\ attack.


The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.


The affected product is vulnerable to improper input validation in the restore file. This enables an attacker to provide malicious config files to replace any file on disk.


A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call which results in mapping sensitive System Management Network (SMN) registers leading to a loss of integrity and availability.


A malicious or compromised UApp or ABL may be used by an attacker to issue a malformed system call to the Stage 2 Bootloader potentially leading to corrupt memory and code execution.


A malicious or compromised UApp or ABL could potentially change the value that the ASP uses for its reserved DRAM to one outside of the fenced area potentially leading to data exposure.


A malicious or compromised UApp or ABL may be used by an attacker to send a malformed system call to the bootloader resulting in out-of-bounds memory accesses.

malicious app
out of bound memory access


A malicious or compromised UApp or ABL may coerce the bootloader into corrupting arbitrary memory potentially leading to loss of integrity of data.


A malicious or compromised User Application (UApp) or AGESA Boot Loader (ABL) could be used by an attacker to exfiltrate arbitrary memory from the ASP stage 2 bootloader potentially leading to information disclosure.


The affected product is vulnerable to a network-based attack by threat actors supplying a crafted malicious XML payload designed to trigger an external entity reference call.


IBM AIX 5.3 6.1 7.1 and 7.2 and VIOS 2.2.x do not default to the latest TLS version which makes it easier for man-in-the-middle attackers to obtain sensitive information via unspecified vectors.


Devolutions Server before 2021.1.18 and LTS before 2020.3.20 allows attackers to intercept private keys via a man-in-the-middle attack against the connections/partial endpoint (which accepts cleartext).


IBM DataPower Gateways 7.1 7 2 7.5 and 7.6 could allow an attacker using man-in-the-middle techniques to spoof DNS responses to perform DNS cache poisoning and redirect Internet traffic. IBM X-Force ID: 136817.


Mahara 16.10 before 16.10.7 17.04 before 17.04.5 and 17.10 before 17.10.2 are vulnerable to being forced via a man-in-the-middle attack to interact with Mahara on the HTTP protocol rather than HTTPS even when an SSL certificate is present.


Symantec Scan Engine 5.0.0.24 and possibly other versions before 5.1.0.7 uses the same private DSA key for each installation which allows remote attackers to conduct man-in-the-middle attacks and decrypt communications.


Symantec Backup Exec 11.0 12.0 12.5 13.0 and 13.0 R2 does not validate identity information sent between the media server and the remote agent which allows man-in-the-middle attackers to execute NDMP commands via unspecified vectors.


ovirt-engine as used in Red Hat MRG 3 allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates.


TinySSL 1.02 and earlier does not verify the Basic Constraints for an intermediate CA-signed certificate which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack.


LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.


ModernBill 5.0.4 and earlier uses cURL with insecure settings for CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST that do not verify SSL certificates which allows remote attackers to read network traffic via a man-in-the-middle (MITM) attack.


Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.


niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks.


Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffic by leveraging a weakness in its encryption protocol. IBM X-Force ID: 105197.


NetApp Clustered Data ONTAP 8.3.1 does not properly verify X.509 certificates from TLS servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Clustered Data ONTAP versions 9.0 and higher do not enforce hostname verification under certain circumstances making them susceptible to impersonation via man-in-the-middle attacks.


The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.


The default configuration of Apache Maven 3.0.4 when using Maven Wagon 2.1 disables SSL certificate checks which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.


A flaw was found in Keycloak in versions before 10.0.0 where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.


FaceTime in Apple iOS before 4.1 on the iPhone and iPod touch does not properly handle invalid X.509 certificates which allows man-in-the-middle attackers to redirect calls via a crafted certificate.


WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource cache of an SSL web site with an invalid X.509 certificate.


WebKit in Apple iOS before 9 mishandles \Content-Disposition: attachment\ HTTP headers which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors.


FaceTime in Apple iOS before 9.3.3 and OS X before 10.11.6 allows man-in-the-middle attackers to spoof relayed-call termination and obtain sensitive audio information in opportunistic circumstances via unspecified vectors.


Mail in Apple iOS before 10 mishandles certificates which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.


CalDAV in Apple iOS before 5 does not validate X.509 certificates for SSL sessions which allows man-in-the-middle attackers to spoof calendar servers and obtain sensitive information via an arbitrary certificate.


Mail in Apple iPhone 1.1.1 when using SSL does not warn the user when the mail server changes or is not trusted which might allow remote attackers to steal credentials and read email via a man-in-the-middle (MITM) attack.


CFNetwork in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 does not properly validate certificates which allows remote attackers to spoof trusted SSL certificates via a man-in-the-middle attack.


CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via crafted responses.


AirScan in Apple OS X before 10.11 allows man-in-the-middle attackers to obtain eSCL packet payload data via unspecified vectors.


A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection aka 'Windows NTLM Tampering Vulnerability'.


An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp the server chooses which files/directories are sent to the client. However the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed the server can manipulate subdirectories as well (for example to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago at version 1.8.


** DISPUTED ** Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. NOTE: The vendor does not consider this a vulnerability of the Unbound software. create_unbound_ad_servers.sh is a contributed script from the community that facilitates automatic configuration creation. It is not part of the Unbound installation.


MikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle can downgrade the client's authentication protocol and recover the user's username and MD5 hashed password.


Kubevirt/virt-cdi-importer versions 1.4.0 to 1.5.3 inclusive were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component leading to possible undetected tampering of trusted container image content.


A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL which can result in a possibility of various attacks like man-in-the-middle.


An issue was discovered in rcp in NetKit through 0.17. For an rcp operation the server chooses which files/directories are sent to the client. However the rcp client only performs cursory validation of the object name returned. A malicious rsh server (or Man-in-The-Middle attacker) can overwrite arbitrary files in a directory on the rcp client machine. This is similar to CVE-2019-6111.


Pagure 5.2 leaks API keys by e-mailing them to users. Few e-mail servers validate TLS certificates so it is easy for man-in-the-middle attackers to read these e-mails and gain access to Pagure on behalf of other users. This issue is found in the API token expiration reminder cron job in files/api_key_expire_mail.py; disabling that job is also a viable solution. (E-mailing a substring of the API key was an attempted but rejected solution.)


Amazon Fire OS before 5.3.6.4 allows a man-in-the-middle attack against HTTP requests for \Terms of Use\ and Privacy pages.


An issue was discovered in the Bosch Smart Camera App before 1.3.1 for Android. Due to improperly implemented TLS certificate checks a malicious actor could potentially succeed in executing a man-in-the-middle attack for some connections. (The Bosch Smart Home App is not affected. iOS Apps are not affected.)


A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones versions 5.1.0.2051 SP2 and earlier could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. A successful exploit may allow the attacker to intercept sensitive information.


An encryption key vulnerability on Mitel SIP-DECT wireless devices 8.0 and 8.1 could allow an attacker to launch a man-in-the-middle attack. A successful exploit may allow the attacker to intercept sensitive information.


The NTV News24 prior to Ver.3.0.0 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


On BIG-IP 11.5.1-11.5.4 11.6.1 and 12.1.0 a virtual server configured with a Client SSL profile may be vulnerable to a chosen ciphertext attack against CBC ciphers. When exploited this may result in plaintext recovery of encrypted messages through a man-in-the-middle (MITM) attack despite the attacker not having gained access to the server's private key itself. (CVE-2019-6593 also known as Zombie POODLE and GOLDENDOODLE.)


An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output e.g. by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.


In OpenSSH 7.9 due to accepting and displaying arbitrary stderr output from the server a malicious server (or Man-in-The-Middle attacker) can manipulate the client output for example to use ANSI control codes to hide additional files being transferred.


IBM QRadar 7.3.0 to 7.3.3 Patch 2 does not validate or incorrectly validates a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-ForceID: 170965.


The SIP TLS module of Huawei CloudLink Phone 7900 with V600R019C10 has a TLS certificate verification vulnerability. Due to insufficient verification of specific parameters of the TLS server certificate attackers can perform man-in-the-middle attacks leading to the affected phones registered abnormally affecting the availability of IP phones.


Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates which could result in man-in-the-middle attacks.


An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt versions 18.06.4 and 15.05.1. When connecting to a remote server the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack providing any certificate leading to the theft of all the data sent by the client during the first request. After an SSL connection is initialized via _ustream_ssl_init and after any data (e.g. the client's HTTP request) is written to the stream using ustream_printf the code eventually enters the function __ustream_ssl_poll which is used to dispatch the read/write events


The Android App 'Tootdon for Mastodon' version 3.4.1 and earlier does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Multiple padding oracle vulnerabilities (Zombie POODLE GOLDENDOODLE OpenSSL 0-length) in the CBC padding implementation of FortiOS IPS engine version 5.000 to 5.006 4.000 to 4.036 4.200 to 4.219 3.547 and below when configured with SSL Deep Inspection policies and with the IPS sensor enabled may allow an attacker to decipher TLS connections going through the FortiGate via monitoring the traffic in a Man-in-the-middle position.


Improper download file verification vulnerability in VAIO Update 7.3.0.03150 and earlier allows remote attackers to conduct a man-in-the-middle attack via a malicous wireless LAN access point. A successful exploitation may result in a malicious file being downloaded/executed.


An exploitable information leak vulnerability exists in the ustream-ssl library of OpenWrt versions 18.06.4 and 15.05.1. When connecting to a remote server the server's SSL certificate is checked but no action is taken when the certificate is invalid. An attacker could exploit this behavior by performing a man-in-the-middle attack providing any certificate leading to the theft of all the data sent by the client during the first request.


There is a man-in-the-middle (MITM) vulnerability on Huawei P30 smartphones versions before ELE-AL00 9.1.0.162(C01E160R1P12/C01E160R2P1) and P30 Pro versions before VOG-AL00 9.1.0.162 (C01E160R1P12/C01E160R2P1). When users establish connection and transfer data through Huawei Share an attacker could sniff spoof and do a series of operations to intrude the Huawei Share connection and launch a man-in-the-middle attack to obtain and tamper the data. (Vulnerability ID: HWPSIRT-2019-03109)


One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. This issue is fixed in version 8.1.4.


The Fujitsu TLS library allows a man-in-the-middle attack. This affects Interstage Application Development Cycle Manager V10 and other versions Interstage Application Server V12 and other versions Interstage Business Application Manager V2 and other versions Interstage Information Integrator V11 and other versions Interstage Job Workload Server V8 Interstage List Works V10 and other versions Interstage Studio V12 and other versions Interstage Web Server Express V11 Linkexpress V5 Safeauthor V3 ServerView Resource Orchestrator V3 Systemwalker Cloud Business Service Management V1 Systemwalker Desktop Keeper V15 Systemwalker Desktop Patrol V15 Systemwalker IT Change Manager V14 Systemwalker Operation Manager V16 and other versions Systemwalker Runbook Automation V15 and other versions Systemwalker Security Control V1 and Systemwalker Software Configuration Manager V15.


Description: Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 applications are potentially vulnerable to man-in-the-middle attacks when the applications download resources from the Dashboard web service. This vulnerability may allow an attacker to substitute downloaded resources with arbitrary files.


In the client side of Heimdal before 7.6.0 failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.


A vulnerability in the HTTP client feature of Cisco IOS and IOS XE Software could allow an unauthenticated remote attacker to read and modify data that should normally have been sent via an encrypted channel. The vulnerability is due to TCP port information not being considered when matching new requests to existing persistent HTTP connections. An attacker could exploit this vulnerability by acting as a man-in-the-middle and then reading and/or modifying data that should normally have been sent through an encrypted channel.


A vulnerability in Cisco HyperFlex Software could allow an unauthenticated remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.


When Apache Tomcat 9.0.0.M1 to 9.0.28 8.5.0 to 8.5.47 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.


In all versions prior to version 3.9.6 for eclipse-wtp all versions prior to version 9.4.4 for eclipse-cdt and all versions prior to version 3.0.1 for eclipse-groovy Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens we can not guarantee that this artifact was not compromised even though the probability that this happened is low.


When TLS is enabled with ssl-endpoint-identification-enabled set to true Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.


A vulnerability has been identified in SIMATIC CP 1626 (All versions) SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions) SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V20.8) SIMATIC HMI Panel (incl. SIPLUS variants) (All versions) SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14) SIMATIC NET PC Software V15 (All versions) SIMATIC S7 PLCSIM Advanced (All versions < V3.0) SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.4) SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) excluding CPU 1518 MFP (and related SIPLUS variant) (All versions < V2.8.1) SIMATIC S7-1500 Software Controller (All versions < V20.8) SIMATIC STEP 7 (TIA Portal) (All versions < V16) SIMATIC WinCC (TIA Portal) (All versions < V16) SIMATIC WinCC OA (All versions < V3.16 P013) SIMATIC WinCC Runtime Advanced (All versions < V16) SIMATIC WinCC Runtime Professional (All versions < V16) TIM 1531 IRC (incl. SIPLUS NET variants) (All versions < V2.1). Affected devices contain a message protection bypass vulnerability due to certain properties in the calculation used for integrity protection. This could allow an attacker in a Man-in-the-Middle position to modify network traffic sent on port 102/tcp to the affected devices.


Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack.


In Pivotal tc Server 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10 and Pivotal tc Runtimes 7.x versions prior to 7.0.99.B 8.x versions prior to 8.5.47.A and 9.x versions prior to 9.0.27.A when a tc Runtime instance is configured with the JMX Socket Listener a local attacker without access to the tc Runtime process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the tc Runtime instance.


A man-in-the-middle vulnerability related to vCenter access was found in Cohesity DataPlatform version 5.x and 6.x prior to 6.1.1c. Cohesity clusters did not verify TLS certificates presented by vCenter. This vulnerability could expose Cohesity user credentials configured to access vCenter.


There

was

a

man-in-the-middle

(MITM)

vulnerability

present

in

the

Confluence

Previews

plugin

in

Confluence

Server

and

Confluence

Data

Center.

This

plugin

was

used

to

facilitate

communication

with

the

Atlassian

Companion

application.

The

Confluence

Previews

plugin

in

Confluence

Server

and

Confluence

Data

Center

communicated

with

the

Companion

application

via

the

atlassian-domain-for-localhost-connections-only.com

domain

name

the

DNS

A

record

of

which

points

at

Additionally

a

signed

certificate

for

the

domain

was

publicly

distributed

with

the

Companion

application.

An

attacker

in

the

position

to

control

DNS

resolution

of

their

victim

could

carry

out

a

man-in-the-middle

(MITM)

attack

between

Confluence

Server

(or

Confluence

Data

Center)

and

the

domain

intended

to

be

used

with

the

Companion

application.

This

certificate

has

been

revoked

however

usage

of

the

domain

name

was

still

present

in

Confluence

Server

and

Confluence

Data

Center.

An

attacker

could

perform

the

described

attack

by

denying

their

victim

access

to

certificate

revocation

information

and

carry

out

a

man-in-the-middle

(MITM)

attack

to

observe

files

being

edited

using

the

Companion

application

and/or

modify

them

and

access

some

limited

user

information.


A malicious file upload vulnerability was discovered in Xiaomi Millet mobile phones 1-6.3.9.3. A particular condition involving a man-in-the-middle attack may lead to partial data leakage or malicious file writing.


python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2 1.6.5ubuntu0.1 1.1.0~beta1ubuntu0.16.04.7 0.9.3.5ubuntu3+esm2 and 0.8.3ubuntu7.5.


The

Tecno

Camon

iClick

Android

device

with

a

build

fingerprint

of

contains

a

pre-installed

platform

app

with

a

package

name

of

com.lovelyfont.defcontainer

This

app

contains

an

exported

service

named

com.lovelyfont.manager.FontCoverService

that

allows

any

app

co-located

on

the

device

to

supply

arbitrary

commands

to

be

executed

as

the

system

user.

This

app

cannot

be

disabled

by

the

user

and

the

attack

can

be

performed

by

a

zero-permission

app.

In

addition

to

the

local

attack

surface

its

accompanying

app

with

a

package

name

of

com.ekesoo.lovelyhifonts

makes

network

requests

using

HTTP

and

an

attacker

can

perform

a

Man-in-the-Middle

(MITM)

attack

on

the

connection

to

inject

a

command

in

a

network

response

that

will

be

executed

as

the

system

user

by

the

com.lovelyfont.defcontainer

app.

Executing

commands

as

the

system

user

can

allow

a

third-party

app

to

video

record

the

user's

screen

factory

reset

the

device

obtain

the

user's

notifications

read

the

logcat

logs

inject

events

in

the

Graphical

User

Interface

(GUI)

and

obtains

the

user's

text

messages

and

more.

Executing

commands

as

the

system

user

can

allow

a

third-party

app

to

factory

reset

the

device

obtain

the

user's

notifications

read

the

logcat

logs

inject

events

in

the

GUI

change

the

default

Input

Method

Editor

(IME)

(e.g.

keyboard)

with

one

contained

within

the

attacking

app

that

contains

keylogging

functionality

and

obtains

the

user's

text

messages

and

more.


The

Coolpad

Android

device

with

a

build

fingerprint

of

Coolpad/android/android:8.1.0/O11019/1534834761:userdebug/release-keys

contains

a

pre-installed

platform

app

with

a

package

name

of

com.lovelyfont.defcontainer

This

app

contains

an

exported

service

named

com.lovelyfont.manager.FontCoverService

that

allows

any

app

co-located

on

the

device

to

supply

arbitrary

commands

to

be

executed

as

the

system

user.

This

app

cannot

be

disabled

by

the

user

and

the

attack

can

be

performed

by

a

zero-permission

app.

In

addition

to

the

local

attack

surface

its

accompanying

app

with

a

package

name

of

com.ekesoo.lovelyhifonts

makes

network

requests

using

HTTP

and

an

attacker

can

perform

a

Man-in-the-Middle

(MITM)

attack

on

the

connection

to

inject

a

command

in

a

network

response

that

will

be

executed

as

the

system

user

by

the

com.lovelyfont.defcontainer

app.

Executing

commands

as

the

system

user

can

allow

a

third-party

app

to

video

record

the

user's

screen

factory

reset

the

device

obtain

the

user's

notifications

read

the

logcat

logs

inject

events

in

the

Graphical

User

Interface

(GUI)

and

obtains

the

user's

text

messages

and

more.

Executing

commands

as

the

system

user

can

allow

a

third-party

app

to

factory

reset

the

device

obtain

the

user's

notifications

read

the

logcat

logs

inject

events

in

the

GUI

change

the

default

Input

Method

Editor

(IME)

(e.g.

keyboard)

with

one

contained

within

the

attacking

app

that

contains

keylogging

functionality

and

obtains

the

user's

text

messages

and

more.


The

Haier

Android

device

with

a

build

fingerprint

of

Haier/A6/A6:8.1.0/O11019/1534219877:userdebug/release-keys

contains

a

pre-installed

platform

app

with

a

package

name

of

com.lovelyfont.defcontainer

This

app

contains

an

exported

service

named

com.lovelyfont.manager.FontCoverService

that

allows

any

app

co-located

on

the

device

to

supply

arbitrary

commands

to

be

executed

as

the

system

user.

This

app

cannot

be

disabled

by

the

user

and

the

attack

can

be

performed

by

a

zero-permission

app.

In

addition

to

the

local

attack

surface

its

accompanying

app

with

a

package

name

of

com.ekesoo.lovelyhifonts

makes

network

requests

using

HTTP

and

an

attacker

can

perform

a

Man-in-the-Middle

(MITM)

attack

on

the

connection

to

inject

a

command

in

a

network

response

that

will

be

executed

as

the

system

user

by

the

com.lovelyfont.defcontainer

app.

Executing

commands

as

the

system

user

can

allow

a

third-party

app

to

video

record

the

user's

screen

factory

reset

the

device

obtain

the

user's

notifications

read

the

logcat

logs

inject

events

in

the

Graphical

User

Interface

(GUI)

and

obtains

the

user's

text

messages

and

more.

Executing

commands

as

the

system

user

can

allow

a

third-party

app

to

factory

reset

the

device

obtain

the

user's

notifications

read

the

logcat

logs

inject

events

in

the

GUI

change

the

default

Input

Method

Editor

(IME)

(e.g.

keyboard)

with

one

contained

within

the

attacking

app

that

contains

keylogging

functionality

and

obtains

the

user's

text

messages

and

more.


A vulnerability was found in OpenShift builds versions 4.1 up to 4.3. Builds that extract source from a container image bypass the TLS hostname verification. An attacker can take advantage of this flaw by launching a man-in-the-middle attack and injecting malicious content.


The mAadhaar application 1.2.7 for Android lacks SSL Certificate Validation leading to man-in-the-middle attacks against requests for FAQs or Help.


Jamf Self Service 10.9.0 allows man-in-the-middle attackers to obtain a root shell by leveraging the \publish Bash shell scripts\ feature to insert \/Applications/Utilities/Terminal app/Contents/MacOS/Terminal\ into the TCP data stream.


On Android systems Firefox can load a library from APITRACE_LIB which is writable by all users and applications. This could allow malicious third party applications to execute a man-in-the-middle attack if a malicious code was written to that location and loaded. *Note: This issue only affects Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 66.


The Upgrade-Insecure-Requests (UIR) specification states that if UIR is enabled through Content Security Policy (CSP) navigation to a same-origin URL must be upgraded to HTTPS. Firefox will incorrectly navigate to an HTTP URL rather than perform the security upgrade requested by the CSP in some circumstances allowing for potential man-in-the-middle attacks on the linked resources. This vulnerability affects Firefox < 66.


Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin enabling man-in-the-middle attacks.


Unencrypted HTTP communications for firmware upgrades in Petalk AI and PF-103 allow man-in-the-middle attackers to run arbitrary code as the root user.


A vulnerability in The ReportsTrustManager class of Brocade SANnav versions before v2.0 could allow an attacker to perform a man-in-the-middle attack against Secure Sockets Layer(SSL)connections.


Missing SSL Certificate Validation in the Nutfind.com application through 3.9.12 for Android allows a man-in-the-middle attacker to sniff and manipulate all API requests including login credentials and location data.


Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks allowing man-in-the-middle attackers to have Jenkins parse crafted XML documents.


The Help feature in the ES File Explorer File Manager application 4.1.9.7.4 for Android allows session hijacking by a Man-in-the-middle attacker on the local network because HTTPS is not used and an attacker's web site is displayed in a WebView with no information about the URL.


Gemalto Admin Control Center all versions prior to 7.92 uses cleartext HTTP to communicate with www3.safenet-inc.com to obtain language packs. This allows attacker to do man-in-the-middle (MITM) attack and replace original language pack by malicious one.


WebHybridClient.java in PayPal 5.3 and earlier for Android ignores SSL errors which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.


in

Async

Http

Client

(aka

AHC

or

async-http-client)

before

does

not

require

a

hostname

match

during

verification

of

certificates

which

allows

man-in-the-middle

attackers

to

spoof

HTTPS

servers

via

an

arbitrary

valid

certificate.


The ssl_do_connect function in common/server.c in HexChat before 2.10.2 XChat and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.


Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.


Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration as demonstrated by a configuration that does not send client certificates.


Check Point Endpoint Security MI Server through R73 3.0.0 HFA2.5 does not configure X.509 certificate validation for client devices which allows man-in-the-middle attackers to spoof SSL servers by presenting an arbitrary certificate during a session established by a client.


Mozilla Firefox before 26.0 Firefox ESR 24.x before 24.2 Thunderbird before 24.2 and SeaMonkey before 2.23 do not recognize a user's removal of trust from an EV X.509 certificate which makes it easier for man-in-the-middle attackers to spoof SSL servers in opportunistic circumstances via a valid certificate that is unacceptable to the user.


The client in OpenText Exceed OnDemand (EoD) 8 supports anonymous ciphers by default which allows man-in-the-middle attackers to bypass server certificate validation redirect a connection and obtain sensitive information via crafted responses.


The remote-viewer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.3 when using a native SPICE client invocation method initially makes insecure connections to the SPICE server which allows man-in-the-middle attackers to spoof the SPICE server.


OpenText Exceed OnDemand (EoD) 8 allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via a crafted string in a response which triggers a downgrade to simple authentication that sends credentials in plaintext.


The ONEDC app before 1.7 for iOS does not properly verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Belkin WeMo Home Automation firmware before 3949 does not maintain a set of Certification Authority public keys which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary X.509 certificate.


The GnuTLS backend in libcurl 7.21.4 through 7.33.0 when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER) also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.


PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Belkin WeMo Home Automation firmware before 3949 does not use SSL for the distribution feed which allows man-in-the-middle attackers to install arbitrary firmware by spoofing a distribution server.


The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


FortiClient before 4.3.5.472 on Windows before 4.0.3.134 on Mac OS X and before 4.0 on Android; FortiClient Lite before 4.3.4.461 on Windows; FortiClient Lite 2.0 through 2.0.0223 on Android; and FortiClient SSL VPN before 4.0.2258 on Linux proceed with an SSL session after determining that the server's X.509 certificate is invalid which allows man-in-the-middle attackers to obtain sensitive information by leveraging a password transmission that occurs before the user warning about the certificate problem.


libgadu before 1.12.0 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers.


The Yahoo! Japan Yafuoku! application 4.3.0 and earlier for iOS and Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority a related issue to CVE-2009-2408.


The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.


The Yahoo! Japan Shopping application 1.4 and earlier for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Google Glass before XE6 does not properly restrict the processing of QR codes which allows physically proximate attackers to modify the configuration or redirect users to arbitrary web sites via a crafted symbol as demonstrated by selecting a Wi-Fi access point in order to conduct a man-in-the-middle attack.


The

OpenSSL::SSL.verify_certificate_identity

function

in

in

Ruby

before

before

and

before

does

not

properly

handle

a

character

in

a

domain

name

in

the

Subject

Alternative

Name

field

of

an

certificate

which

allows

man-in-the-middle

attackers

to

spoof

arbitrary

SSL

servers

via

a

crafted

certificate

issued

by

a

legitimate

Certification

Authority

a

related

issue

to


cURL and libcurl 7.18.0 through 7.32.0 when built with OpenSSL disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority a related issue to CVE-2009-2408.


IBM Rational Policy Tester 8.5 before 8.5.0.5 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof Jazz Team servers obtain sensitive information and modify the client-server data stream via a crafted certificate.


The mirroring support (-M --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.


Kingsoft KDrive Personal before 1.21.0.1880 on Windows does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Zimbra Collaboration Suite (ZCS) 6.0.16 and earlier allows man-in-the-middle attackers to obtain access by sniffing the network and replaying the ZM_AUTH_TOKEN token.


IBM Security AppScan Enterprise 8.5 through 8.7.0.1 when Jazz authentication is enabled allows man-in-the-middle attackers to obtain sensitive information or modify data by leveraging an improperly protected URL to obtain a session token.


The RADIUS service in Server App in Apple OS X Server before 3.0 selects a fallback X.509 certificate in unspecified circumstances which might allow man-in-the-middle attackers to hijack RADIUS sessions by leveraging knowledge of the private key that matches this fallback certificate.


apt 0.8.16 0.9.7 and possibly other versions does not properly handle InRelease files which allows man-in-the-middle attackers to modify packages before installation via unknown vectors possibly related to integrity checking and the use of third-party repositories.


The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509 certificates which allows man-in-the-middle attackers to spoof servers and intercept or modify Virtual Supervisor Module (VSM) to VMware vCenter communication via a crafted certificate aka Bug ID CSCud14837.


The Cisco Network Admission Control (NAC) agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine (ISE) server during an SSL session which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate aka Bug ID CSCub24309.


maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack.


OXUpdater in Open-Xchange Server before 6.20.7 rev14 6.22.0 before rev13 and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate.


Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91 does not properly validate SSL certificates when creating accounts for providers who use the libsoup library which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.


Cisco Jabber on Windows does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and modify the client-server data stream via a crafted certificate aka Bug ID CSCug30280.


The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4 when connecting to a \legacy Jabber server \ does not properly enforce the WockyConnector:tls-required flag which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.


The IPSec implementation in Apple Mac OS X before 10.8.5 when Hybrid Auth is used does not verify X.509 certificates from security gateways which allows man-in-the-middle attackers to spoof security gateways and obtain sensitive information via a crafted certificate.


The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4 when the TLS False Start feature is enabled allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.


Apple iTunes before 11.0.3 does not properly verify X.509 certificates which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.


The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Isync 0.4 before 1.0.6 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Mozilla Firefox before 19.0 Firefox ESR 17.x before 17.0.3 Thunderbird before 17.0.3 Thunderbird ESR 17.x before 17.0.3 and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script as demonstrated by a phishing attack on an HTTPS site.


The SSL provider component in Microsoft Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 Windows Server 2012 and Windows RT does not properly handle encrypted packets which allows man-in-the-middle attackers to conduct SSLv2 downgrade attacks against (1) SSLv3 sessions or (2) TLS sessions by intercepting handshakes and injecting content aka \Microsoft SSL Version 3 and TLS Protocol Security Feature Bypass Vulnerability.\


EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server which allows man-in-the-middle attackers to hijack the test account by capturing these cookies.


Gnome Online Accounts (GOA) 3.4.x 3.6.x before 3.6.3 and 3.7.x before 3.7.5 does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.


The Web GUI in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.1.0 and 6.4 before 6.4.0.1 allows man-in-the-middle attackers to obtain unspecified client access and consequently obtain unspecified server access via unknown vectors.


Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream.


python-bugzilla before 0.9.0 does not validate X.509 certificates which allows man-in-the-middle attackers to spoof Bugzilla servers via a crafted certificate.


IBM InfoSphere Optim Data Growth for Oracle E-Business Suite 6.x 7.x and 9.x before 9.1.0.3 relies on the MD5 algorithm for signatures in X.509 certificates which makes it easier for man-in-the-middle attackers to spoof SSL servers via a crafted certificate.


Transifex command-line client before 0.9 does not validate X.509 certificates which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate.


The installation functionality in the Novell Kanaka component before 2.8 for Novell Open Enterprise Server (OES) on Mac OS X does not verify the server's X.509 certificate during an SSL session which allows man-in-the-middle attackers to spoof servers via an arbitrary certificate.


FileMaker Pro before 12 and Pro Advanced before 12 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The HTTPS implementation in Google Chrome before 28.0.1500.71 does not ensure that headers are terminated by \\r\\n\\r\\n (carriage return newline carriage return newline) which allows man-in-the-middle attackers to have an unspecified impact via vectors that trigger header truncation.


The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha 0.23.x before 0.23.9 and 1.x before 1.2.1 when the Kerberos security features are enabled allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.


The urlopen function in pym/portage/util/_urlopen.py in Gentoo Portage 2.1.12 when using HTTPS does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate.


Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9 when the Kerberos features are enabled allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information via unspecified vectors.


httplib2 0.7.2 0.8 and earlier after an initial connection is made does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.


The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header which makes it easier for man-in-the-middle attackers to hijack sessions or obtain sensitive information by leveraging the presence of HTTP requests.


DirectAccess in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 does not properly verify server X.509 certificates which allows man-in-the-middle attackers to spoof servers and read encrypted domain credentials via a crafted certificate.


The HTTPS protocol as used in unspecified web applications can encrypt compressed data without properly obfuscating the length of the unencrypted data which makes it easier for man-in-the-middle attackers to obtain plaintext secret values by observing length differences during a series of guesses in which a string in an HTTP request URL potentially matches an unknown string in an HTTP response body aka a \BREACH\ attack a different issue than CVE-2012-4929.


Juniper Junos Pulse Secure Access Service (aka SSL VPN) with IVE OS 7.0r2 through 7.0r8 and 7.1r1 through 7.1r5 and Junos Pulse Access Control Service (aka UAC) with UAC OS 4.1r1 through 4.1r5 include a test Certification Authority (CA) certificate in the Trusted Server CAs list which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging control over that test CA.


The Pizza Hut Japan Official Order application before 1.1.1.a for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


IBM Security AppScan Enterprise 8.x before 8.8 sends a cleartext AppScan Source database password in a response which allows remote authenticated users to obtain sensitive information and subsequently conduct man-in-the-middle attacks by examining the response content.


** DISPUTED ** The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console.


In KDE Trojita 0.7 man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS.


A man-in-the-middle vulnerability in Cohesity DataPlatform support channel in version 6.3 up to 6.3.1g 6.4 up to 6.4.1c and 6.5.1 through 6.5.1b. Missing server authentication in impacted versions can allow an attacker to Man-in-the-middle (MITM) support channel UI session to Cohesity DataPlatform cluster.


The Portal Store module in Liferay Portal 7.0.0 through 7.3.5 and Liferay DXP 7.0 before fix pack 97 7.1 before fix pack 21 7.2 before fix pack 10 and 7.3 before fix pack 1 does not obfuscate the S3 store's proxy password which allows attackers to steal the proxy password via man-in-the-middle attacks or shoulder surfing.


DoTls13CertificateVerify in tls13.c in wolfSSL before 4.7.0 does not cease processing for certain anomalous peer behavior (sending an ED22519 ED448 ECC or RSA signature without the corresponding certificate). The client side is affected because man-in-the-middle attackers can impersonate TLS 1.3 servers.


When PgBouncer is configured to use \cert\ authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1.


Agenzia delle Entrate Desktop Telematico 1.0.0 contacts the jws.agenziaentrate.it server over cleartext HTTP which allows man-in-the-middle attackers to spoof product updates.


OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unrelated server certificate using the same hostname found in the verify-x509-name option in a client configuration.


A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate thus an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.


Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) could allow an attacker to spoof a trusted host or construct a man-in-the-middle attack to extract sensitive information or alter certain API requests. These vulnerabilities are due to insufficient certificate validation when establishing HTTPS requests with the affected device. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the Cisco Advanced Malware Protection (AMP) for Endpoints integration of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco Web Security Appliance (WSA) could allow an unauthenticated remote attacker to intercept traffic between an affected device and the AMP servers. This vulnerability is due to improper certificate validation when an affected device establishes TLS connections. A man-in-the-middle attacker could exploit this vulnerability by sending a crafted TLS packet to an affected device. A successful exploit could allow the attacker to spoof a trusted host and then extract sensitive information or alter certain API requests.


The Juniper Networks CTPView server is not enforcing HTTP Strict Transport Security (HSTS). HSTS is an optional response header which allows servers to indicate that content from the requested domain will only be served over HTTPS. The lack of HSTS may leave the system vulnerable to downgrade attacks SSL-stripping man-in-the-middle attacks and weakens cookie-hijacking protections. This issue affects Juniper Networks CTPView: 7.3 versions prior to 7.3R7; 9.1 versions prior to 9.1R3.


A man-in-the-middle attacker can inject false responses to the client's first few queries despite the use of SSL certificate verification and encryption.


Improper certificate validation vulnerability in SMTP Client allows man-in-the-middle attack to retrieve sensitive information from the Command Centre Server. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3); 8.40 versions prior to 8.40.2063 (MR4); 8.30 versions prior to 8.30.1454 (MR4) ; version 8.20 and prior versions.


Improper validation of the cloud certificate chain in Mobile Connect allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Connect for Android 15 versions prior to 15.04.040; version 14 and prior versions.


When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established despite the use of SSL certificate verification and encryption.


Improper validation of the cloud certificate chain in Mobile Client allows man-in-the-middle attack to impersonate the legitimate Command Centre Server. This issue affects: Gallagher Command Centre Mobile Client for Android 8.60 versions prior to 8.60.065; version 8.50 and prior versions.


A vulnerability in the web-based management interface of multiple Cisco Small Business Series Switches could allow an unauthenticated remote attacker to replay valid user session credentials and gain unauthorized access to the web-based management interface of an affected device. This vulnerability is due to insufficient expiration of session credentials. An attacker could exploit this vulnerability by conducting a man-in-the-middle attack against an affected device to intercept valid session credentials and then replaying the intercepted credentials toward the same device at a later time. A successful exploit could allow the attacker to access the web-based management interface with administrator privileges.


Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.


Affected versions of CODESYS Git in Versions prior to V1.1.0.0 lack certificate validation in HTTPS handshakes. CODESYS Git does not implement certificate validation by default so it does not verify that the server provides a valid and trusted HTTPS certificate. Since the certificate of the server to which the connection is made is not properly verified the server connection is vulnerable to a man-in-the-middle attack.


An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not perform authentication.


The FTL Server (tibftlserver) and Docker images containing tibftlserver components of TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition TIBCO ActiveSpaces - Developer Edition TIBCO ActiveSpaces - Enterprise Edition TIBCO FTL - Community Edition TIBCO FTL - Developer Edition TIBCO FTL - Enterprise Edition TIBCO eFTL - Community Edition TIBCO eFTL - Developer Edition and TIBCO eFTL - Enterprise Edition contain a vulnerability that theoretically allows a non-administrative authenticated FTL user to trick the affected components into creating illegitimate certificates. These maliciously generated certificates can be used to enable man-in-the-middle attacks or to escalate privileges so that the malicious user has administrative privileges. Affected releases are TIBCO Software Inc.'s TIBCO ActiveSpaces - Community Edition: versions 4.3.0 4.4.0 4.5.0 4.6.0 4.6.1 and 4.6.2 TIBCO ActiveSpaces - Developer Edition: versions 4.3.0 4.4.0 4.5.0 4.6.0 4.6.1 and 4.6.2 TIBCO ActiveSpaces - Enterprise Edition: versions 4.3.0 4.4.0 4.5.0 4.6.0 4.6.1 and 4.6.2 TIBCO FTL - Community Edition: versions 6.2.0 6.3.0 6.3.1 6.4.0 6.5.0 6.6.0 6.6.1 and 6.7.0 TIBCO FTL - Developer Edition: versions 6.2.0 6.3.0 6.3.1 6.4.0 6.5.0 6.6.0 6.6.1 and 6.7.0 TIBCO FTL - Enterprise Edition: versions 6.2.0 6.3.0 6.3.1 6.4.0 6.5.0 6.6.0 6.6.1 and 6.7.0 TIBCO eFTL - Community Edition: versions 6.2.0 6.3.0 6.3.1 6.4.0 6.5.0 6.6.0 6.6.1 and 6.7.0 TIBCO eFTL - Developer Edition: versions 6.2.0 6.3.0 6.3.1 6.4.0 6.5.0 6.6.0 6.6.1 and 6.7.0 and TIBCO eFTL - Enterprise Edition: versions 6.2.0 6.3.0 6.3.1 6.4.0 6.5.0 6.6.0 6.6.1 and 6.7.0.


A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update. This vulnerability is fixed in EdgeMAX EdgeRouter V2.0.9-hotfix.1 and later.


When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw it allows a Man-In-The-Middle attacker to first inject the fake responses then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.


On all versions of BIG-IP 12.1.x and 11.6.x the original TLS protocol includes a weakness in the master secret negotiation that is mitigated by the Extended Master Secret (EMS) extension defined in RFC 7627. TLS connections that do not use EMS are vulnerable to man-in-the-middle attacks during renegotiation. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack an attacker may alter the communication response. As a result an arbitrary OS command may be executed on the affected device.


The ATOM (ATOM - Smart life App for Android versions prior to 1.8.1 and ATOM - Smart life App for iOS versions prior to 1.8.2) does not verify server certificate properly which allows man-in-the-middle attackers to eavesdrop on encrypted communication via a crafted certificate.


The SNKRDUNK Market Place App for iOS versions prior to 2.2.0 does not verify server certificate properly which allows man-in-the-middle attackers to eavesdrop on and/or alter encrypted communication via a crafted certificate.


Dell Wyse Management Suite version 3.3.1 and prior support insecure Transport Security Protocols TLS 1.0 and TLS 1.1 which are susceptible to Man-In-The-Middle attacks thereby compromising Confidentiality and Integrity of data.


In the xrdp package (in branches through 3.14) for Alpine Linux RDP sessions are vulnerable to man-in-the-middle attacks because pre-generated RSA certificates and private keys are used.


A misconfiguration exists in the MQTTS functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. This misconfiguration significantly simplifies a man-in-the-middle attack which directly leads to control of device functionality.


A file write vulnerability exists in the OTA update task functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to arbitrary file overwrite. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.


An out-of-bounds write vulnerability exists in the URL_decode functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. A specially-crafted MQTT payload can lead to an out-of-bounds write. An attacker can perform a man-in-the-middle attack to trigger this vulnerability.


Mifos-Mobile Android Application for MifosX is an Android Application built on top of the MifosX Self-Service platform. Mifos-Mobile before commit e505f62 disables HTTPS hostname verification of its HTTP client. Additionally it accepted any self-signed certificate as valid. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. Accepting any certificate even self-signed ones allows man-in-the-middle attacks. This problem is fixed in mifos-mobile commit e505f62.


Dell EMC NetWorker versions 18.x 19.1.x 19.2.x 19.3.x 19.4 and 19.4.0.1 contain an Improper Certificate Validation vulnerability in the client (NetWorker Management Console) components which uses SSL encrypted connection in order to communicate with the application server. An unauthenticated attacker in the same network collision domain as the NetWorker Management Console client could potentially exploit this vulnerability to perform man-in-the-middle attacks to intercept and tamper the traffic between the client and the application server.


The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple session renegotiation requests due to insufficient TLS session controls. A successful exploit could allow an attacker to modify application data and state.


The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful exploit could allow an attacker to view and modify data.


An issue was discovered in Ruby through 2.6.7 2.7.x through 2.7.3 and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command aka a \StartTLS stripping attack.\


SICK Visionary-S CX up version 5.21.2.29154R are vulnerable to an Inadequate Encryption Strength vulnerability concerning the internal SSH interface solely used by SICK for recovering returned devices. The use of weak ciphers make it easier for an attacker to break the security that protects information transmitted from the client to the SSH server assuming the attacker has access to the network on which the device is connected. This can increase the risk that encryption will be compromised leading to the exposure of sensitive user information and man-in-the-middle attacks.


A vulnerability has been identified in RUGGEDCOM ROS M2100 (All versions) RUGGEDCOM ROS M2200 (All versions) RUGGEDCOM ROS M969 (All versions) RUGGEDCOM ROS RMC (All versions) RUGGEDCOM ROS RMC20 (All versions) RUGGEDCOM ROS RMC30 (All versions) RUGGEDCOM ROS RMC40 (All versions) RUGGEDCOM ROS RMC41 (All versions) RUGGEDCOM ROS RMC8388 (All versions < V5.6.0) RUGGEDCOM ROS RP110 (All versions) RUGGEDCOM ROS RS400 (All versions) RUGGEDCOM ROS RS401 (All versions) RUGGEDCOM ROS RS416 (All versions) RUGGEDCOM ROS RS416v2 (All versions < V5.6.0) RUGGEDCOM ROS RS8000 (All versions) RUGGEDCOM ROS RS8000A (All versions) RUGGEDCOM ROS RS8000H (All versions) RUGGEDCOM ROS RS8000T (All versions) RUGGEDCOM ROS RS900 (32M) (All versions < V5.6.0) RUGGEDCOM ROS RS900G (All versions) RUGGEDCOM ROS RS900G (32M) (All versions < V5.6.0) RUGGEDCOM ROS RS900GP (All versions) RUGGEDCOM ROS RS900L (All versions) RUGGEDCOM ROS RS900W (All versions) RUGGEDCOM ROS RS910 (All versions) RUGGEDCOM ROS RS910L (All versions) RUGGEDCOM ROS RS910W (All versions) RUGGEDCOM ROS RS920L (All versions) RUGGEDCOM ROS RS920W (All versions) RUGGEDCOM ROS RS930L (All versions) RUGGEDCOM ROS RS930W (All versions) RUGGEDCOM ROS RS940G (All versions) RUGGEDCOM ROS RS969 (All versions) RUGGEDCOM ROS RSG2100 (All versions) RUGGEDCOM ROS RSG2100 (32M) (All versions < V5.6.0) RUGGEDCOM ROS RSG2100P (All versions) RUGGEDCOM ROS RSG2200 (All versions) RUGGEDCOM ROS RSG2288 (All versions < V5.6.0) RUGGEDCOM ROS RSG2300 (All versions < V5.6.0) RUGGEDCOM ROS RSG2300P (All versions < V5.6.0) RUGGEDCOM ROS RSG2488 (All versions < V5.6.0) RUGGEDCOM ROS RSG907R (All versions < V5.6.0) RUGGEDCOM ROS RSG908C (All versions < V5.6.0) RUGGEDCOM ROS RSG909R (All versions < V5.6.0) RUGGEDCOM ROS RSG910C (All versions < V5.6.0) RUGGEDCOM ROS RSG920P (All versions < V5.6.0) RUGGEDCOM ROS RSL910 (All versions < V5.6.0) RUGGEDCOM ROS RST2228 (All versions < V5.6.0) RUGGEDCOM ROS RST2228P (All versions < V5.6.0) RUGGEDCOM ROS RST916C (All versions < V5.6.0) RUGGEDCOM ROS RST916P (All versions < V5.6.0) RUGGEDCOM ROS i800 (All versions) RUGGEDCOM ROS i801 (All versions) RUGGEDCOM ROS i802 (All versions) RUGGEDCOM ROS i803 (All versions). A new variant of the POODLE attack has left a third-party component vulnerable due to the implementation flaws of the CBC encryption mode in TLS 1.0 to 1.2. If an attacker were to exploit this they could act as a man-in-the-middle and eavesdrop on encrypted communications.


An improper scheme check vulnerability in Samsung Themes prior to version 5.2.01 allows attackers to perform Man-in-the-middle attack.


Improper scheme check vulnerability in Samsung Internet prior to version 15.0.2.47 allows attackers to perform Man-in-the-middle attack and obtain Samsung Account token.


An issue was discovered in GNU Hurd before 0.9 20210404-9. The use of an authentication protocol in the proc server is vulnerable to man-in-the-middle attacks which can be exploited for local privilege escalation to get full root access.


In all released versions of Eclipse Equinox at least until version 4.21 (September 2021) installation can be vulnerable to man-in-the-middle attack if using p2 repos that are HTTP; that can then be exploited to serve incorrect p2 metadata and entirely alter the local installation particularly by installing plug-ins that may then run malicious code.


A combination of a use of hard-coded cryptographic key vulnerability CWE-321 in FortiClientEMS 7.0.1 and below 6.4.6 and below and an improper certificate validation vulnerability CWE-297 in FortiClientWindows FortiClientLinux and FortiClientMac 7.0.1 and below 6.4.6 and below may allow an unauthenticated and network adjacent attacker to perform a man-in-the-middle attack between the EMS and the FCT via the telemetry protocol.


On 2N Access Unit 2.0 2.31.0.40.5 devices an attacker can pose as the web relay for a man-in-the-middle attack.


Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php which could lead to man-in-the-middle attacks.


Using the ability to perform a Man-in-the-Middle (MITM) attack which indicates a lack of hostname verification sensitive account information was able to be intercepted. In this specific scenario the application's network traffic was intercepted using a proxy server set up in 'transparent' mode while a certificate with an invalid hostname was active. The Android application was found to have hostname verification issues during the server setup and login flows; however the application did not process requests post-login.


The Proofpoint Insider Threat Management Agents (formerly ObserveIT Agent) for MacOS and Linux perform improper validation of the ITM Server's certificate which enables a remote attacker to intercept and alter these communications using a man-in-the-middle attack. All versions before 7.11.1 are affected. Agents for Windows and Cloud are not affected.


The KT-1 door controller is susceptible to replay or man-in-the-middle attacks where an attacker can record and replay TCP packets. This issue affects Johnson Controls KT-1 all versions up to and including 3.01


Ypsomed mylife Cloud mylife Mobile Application Ypsomed mylife Cloud: All versions prior to 1.7.2 Ypsomed mylife App: All versions prior to 1.7.5 The application encrypts on the application layer of the communication protocol between the Ypsomed mylife App and mylife Cloud credentials based on hard-coded secrets which allows man-in-the-middle attackers to tamper with messages.


Ypsomed mylife Cloud mylife Mobile Application Ypsomed mylife Cloud: All versions prior to 1.7.2 Ypsomed mylife App: All versions prior to 1.7.5 The application layer encryption of the communication protocol between the Ypsomed mylife App and mylife Cloud uses non-random IVs which allows man-in-the-middle attackers to tamper with messages.


There is a man-in-the-middle attack vulnerability during system update download in recovery mode. Successful exploitation of this vulnerability may affect integrity.


An issue was discovered in Rhinode Trading Paints through 2.0.36. TP Updater.exe uses cleartext HTTP to check and request updates. Thus attackers can man-in-the-middle a victim to download a malicious binary in place of the real update with no SSL errors or warnings.


A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.42) Climatix POL909 (AWM module) (All versions < V11.34). The web server of affected devices transmits data without TLS encryption. This could allow an unauthenticated remote attacker in a man-in-the-middle position to read sensitive data such as administrator credentials or modify data in transit.


SSL libraries in BEA WebLogic Server 6.1 Gold through SP7 7.0 Gold through SP7 and 8.1 Gold through SP5 might allow remote attackers to obtain plaintext from an SSL stream via a man-in-the-middle attack that injects crafted data and measures the elapsed time before an error response a different vulnerability than CVE-2006-2461.