VMWare VirtualCenter client 2.x before 2.0.1 Patch 1 (Build 33643) and 1.4.x before 1.4.1 Patch 1 (Build 33425) when server certificate verification is enabled does not verify the server's X.509 certificate when creating an SSL session which allows remote malicious servers to spoof valid servers via a man-in-the-middle attack.


The console in AirMagnet Enterprise before 7.5 build 6307 does not properly validate the Enterprise Server certificate which allows remote attackers to read network traffic via a man-in-the-middle (MITM) attack possibly related to the use of self-signed certificates.


FRAgent.exe in Mandiant First Response (MFR) before 1.1.1 when run in daemon mode and configured to use only HTTP allows local users to modify requests and responses between a client and an agent by hijacking an HTTP FRAgent daemon and conducting a man-in-the-middle (MITM) attack.


EMC RSA Security SiteKey allows remote attackers to display the correct image via a man-in-the-middle (MITM) attack in which an attacker-controlled server proxies authentication data to and from a legitimate SiteKey server. NOTE: the vendor disputes the severity of the issue stating that it is easier to monitor this attack than \attacks against static web pages.\


CMG WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack.


KTH Kerberos IV and Kerberos V (Heimdal) for Telnet clients do not encrypt connections if the server does not support the requested encryption which allows remote attackers to read communications via a man-in-the-middle attack.


Openwave WAP gateway does not verify the fully qualified domain name URL with X.509 certificates from root certificate authorities which allows remote attackers to spoof SSL certificates via a man-in-the-middle attack.


The SSH-1 protocol allows remote servers to conduct man-in-the-middle attacks and replay a client challenge response to a target server by creating a Session ID that matches the Session ID of the target but which uses a public key pair that is weaker than the target's public key which allows the attacker to compute the corresponding private key and use the target's Session ID with the compromised key pair to masquerade as the target.


The Kerberos Telnet protocol as implemented by KTH Kerberos IV and Kerberos V (Heimdal) does not encrypt authentication and encryption options sent from the server which allows remote attackers to downgrade authentication and encryption mechanisms via a man-in-the-middle attack.


A long 'synch' delay in Logitech wireless mice and keyboard receivers allows a remote attacker to hijack connections via a man-in-the-middle attack.


Opera before 9.63 does not properly verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TNS Listener as used in Oracle Database 11g 11.1.0.7 11.2.0.2 and 11.2.0.3 and 10g 10.2.0.3 10.2.0.4 and 10.2.0.5 as used in Oracle Fusion Middleware Enterprise Manager E-Business Suite and possibly other products allows remote attackers to execute arbitrary database commands by performing a remote registration of a database (1) instance or (2) service name that already exists then conducting a man-in-the-middle (MITM) attack to hijack database connections aka \TNS Poison.\


libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate.


The

certificate-warning

functionality

in

in

Mozilla

Firefox

through

Firefox

ESR

before

Thunderbird

through

Thunderbird

ESR

before

and

SeaMonkey

before

does

not

properly

handle

attempted

clickjacking

of

the

about:certerror

page

which

allows

man-in-the-middle

attackers

to

trick

users

into

adding

an

unintended

exception

via

an

IFRAME

element.


The NTT DOCOMO sp mode mail application 5400 and earlier for Android does not properly verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during use of the Manual Explore Proxy feature which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate.


SUSE WebYaST before 1.2 0.2.63-0.6.1 allows remote attackers to modify the hosts list and subsequently conduct man-in-the-middle attacks via a crafted /host request on TCP port 4984.


Aptdaemon 0.43 in Ubuntu 11.10 and 12.04 LTS uses short IDs when importing PPA GPG keys from a keyserver which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack.


The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13 when updating from repositories that use InRelease files allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.


The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


ubiquity-slideshow-ubuntu before 58.2 during installation allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the <a> tag of a Twitter feed.


The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 when adding a host uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.


Aptdaemon 0.43 and earlier in Ubuntu 11.04 11.10 and 12.04 LTS does not authenticate packages when the transaction is not simulated which allows remote attackers to install arbitrary packages via a man-in-the-middle attack.


APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16 when using the apt-key net-update to import keyrings relies on GnuPG argument order and does not check GPG subkeys which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.


IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during scanning which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate.


Cisco IronPort Web Security Appliance AsyncOS software prior to 7.5 has a SSL Certificate Caching vulnerability which could allow man-in-the-middle attacks


Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.


RubyGems before 1.8.23 does not verify an SSL certificate which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.


Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3 (2) IMAP or (3) SMTP protocol via an arbitrary valid certificate.


Cisco IP Communicator 8.6 allows man-in-the-middle attackers to modify the Certificate Trust List via unspecified vectors aka Bug ID CSCtz01471.


RubyGems before 1.8.23 can redirect HTTPS connections to HTTP which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.


The Web Server Plug-in in IBM WebSphere Application Server (WAS) 8.0 and earlier uses unencrypted HTTP communication after expiration of the plugin-key.kdb password which allows remote attackers to obtain sensitive information by sniffing the network or spoof arbitrary servers via a man-in-the-middle attack.


Cisco AnyConnect Secure Mobility Client 3.0 through 3.0.08066 does not ensure that authentication makes use of a legitimate certificate which allows user-assisted man-in-the-middle attackers to spoof servers via a crafted certificate aka Bug ID CSCtz29197.


The IPsec implementation in Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not verify the certificate name in an X.509 certificate which allows man-in-the-middle attackers to spoof servers via a crafted certificate aka Bug ID CSCtz26985.


Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 does not verify the certificate name in an X.509 certificate during WebLaunch of IPsec which allows man-in-the-middle attackers to spoof servers via a crafted certificate aka Bug ID CSCtz29470.


APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16 when using the apt-key net-update to import keyrings relies on GnuPG argument order and does not check GPG subkeys which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.


** DISPUTED ** The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance \does not allow import or export of the foresaid private key.\


The Innominate mGuard Smart HW before HW-101130 and BD before BD-101030 mGuard industrial RS mGuard delta HW before HW-103060 and BD before BD-211010 mGuard PCI mGuard blade and EAGLE mGuard appliances with software before 7.5.0 do not use a sufficient source of entropy for private keys which makes it easier for man-in-the-middle attackers to spoof (1) HTTPS or (2) SSH servers by predicting a key value.


Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.


The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.


The Teiid Java Database Connectivity (JDBC) socket as used in JBoss Enterprise Data Services Platform before 5.3.0 does not encrypt login messages by default contrary to documentation and specification which allows remote attackers to obtain login credentials via a man-in-the-middle (MITM) attack.


http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.


The web-server password-authentication functionality in Rockwell Automation EtherNet/IP products; 1756-ENBT 1756-EWEB 1768-ENBT and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 allows man-in-the-middle attackers to conduct replay attacks via HTTP traffic.


Palo Alto Networks GlobalProtect before 1.1.7 and NetConnect does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof portal servers and obtain sensitive information via a crafted certificate.


libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1 2.0.x before 2.0.8rc1 and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Cisco WebEx 4.1 on iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate aka Bug ID CSCud94176.


IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11 6.2.1 before 6.2.1.3 and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11 6.2.1 before 6.2.1.3 and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.


rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials.


repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11 2.3.x before 2.3.9 2.4.x before 2.4.6 and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to an incorrect CURLOPT_SSL_VERIFYHOST value.


The

org.apache.catalina.connector.Response.encodeURL

method

in

Red

Hat

JBoss

Web

and

earlier

when

the

tracking

mode

is

set

to

COOKIE

sends

the

jsessionid

in

the

URL

of

the

first

response

of

a

session

which

allows

remote

attackers

to

obtain

the

session

id

via

a

man-in-the-middle

attack

or

by

reading

a

log.


IBM XIV Storage System Gen3 before 11.2 relies on a default X.509 v3 certificate for authentication which allows man-in-the-middle attackers to spoof servers by leveraging an inappropriate certificate-trust relationship.


The fabric-interconnect component in Cisco Unified Computing System (UCS) does not encrypt KVM virtual-media data which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify this traffic by inserting packets into the client-server data stream aka Bug ID CSCtr72964.


The Board Management Controller (BMC) in the Serial over LAN (SoL) subsystem in Cisco Unified Computing System (UCS) relies on a hardcoded private key which allows man-in-the-middle attackers to obtain sensitive information or modify the data stream by leveraging knowledge of this key aka Bug ID CSCte90338.


The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack related to a \parameter manipulation\ issue.


The fabric-interconnect KVM module in Cisco Unified Computing System (UCS) does not encrypt video data which allows man-in-the-middle attackers to watch KVM display content by sniffing the network or modify this traffic by inserting packets into the client-server data stream aka Bug ID CSCtr72949.


Siemens RuggedCom Rugged Operating System (ROS) before 3.12 ROX I OS through 1.14.5 ROX II OS through 2.3.0 and RuggedMax OS through 4.2.1.4621.22 use hardcoded private keys for SSL and SSH communication which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network traffic by leveraging the availability of these keys within ROS files at all customer installations.


The default configuration of Fortinet Fortigate UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Fortinet_CA_SSLProxy certificate in a list of trusted root certification authorities.


Moxa EDR-G903 series routers with firmware before 2.11 do not use a sufficient source of entropy for (1) SSH and (2) SSL keys which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation elsewhere.


services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set which might allow remote attackers to obtain sensitive information via a man-in-the-middle (MITM) attack.


The KVM subsystem in Cisco Unified Computing System (UCS) relies on a hardcoded X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers and read keyboard and mouse events by leveraging knowledge of this certificate's private key aka Bug ID CSCte90327.


The SPDY protocol 3 and earlier as used in Mozilla Firefox Google Chrome and other products can perform TLS encryption of compressed data without properly obfuscating the length of the unencrypted data which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header aka a \CRIME\ attack.


Mesh OS before 7.9.1.1 on Tropos wireless mesh routers does not use a sufficient source of entropy for SSH keys which makes it easier for man-in-the-middle attackers to spoof a device or modify a client-server data stream by leveraging knowledge of a key from a product installation elsewhere.


The management interface in the Central Software component in Cisco Unified Computing System (UCS) does not properly validate the identity of vCenter consoles which allows man-in-the-middle attackers to read or modify an inter-device data stream by spoofing an identity aka Bug ID CSCtk00683.


Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.


The TLS protocol 1.2 and earlier as used in Mozilla Firefox Google Chrome Qt and other products can encrypt compressed data without properly obfuscating the length of the unencrypted data which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header aka a \CRIME\ attack.


The KVM subsystem in the client in Cisco Unified Computing System (UCS) does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and read or modify KVM data via a crafted certificate aka Bug ID CSCte90332.


The fabric-interconnect component in Cisco Unified Computing System (UCS) does not properly verify X.509 certificates which allows man-in-the-middle attackers to watch SSL KVM video-channel traffic or modify this traffic via a crafted certificate aka Bug ID CSCtr73033.


Call of Duty Elite for iOS 2.0.1 does not properly validate the server SSL certificate which allows remote attackers to obtain sensitive information via a Man-in-the-Middle (MITM) attack.


The PayPal Pro PayFlow module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to use of the Python httplib library.


Weberknecht as used in GitHub Gaug.es and other products does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The LinkPoint module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Authorize.Net module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Chase mobile banking application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to overriding the default X509TrustManager. NOTE: this vulnerability was fixed in the summer of 2012 but the version number was not changed or is not known.


Lynx does not verify that the server's certificate is signed by a trusted certification authority which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate related to improper use of a certain GnuTLS function.


The PayPal merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3 0.80.x before 0.80.9.2 0.81.x before 0.81.13.5 0.82.x before 0.82.7.3 and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack.


The CyberSource module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Apache Commons HttpClient 3.x as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


ElephantDrive does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The eBay module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


DISPUTED

The

sample

code

in

distribution/src/main/release/samples/wsdl_first_https/src/main/

in

Apache

CXF

before

does

not

verify

that

the

server

hostname

matches

a

domain

name

in

the

subject's

Common

Name

(CN)

or

subjectAltName

field

of

the

certificate

which

allows

man-in-the-middle

attackers

to

spoof

SSL

servers

via

an

arbitrary

valid

certificate.

NOTE:

The

vendor

states

that

the

sample

had

specifically

used

a

flag

to

bypass

the

DN

check.


The PayPal IPN functionality in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate a different vulnerability than CVE-2012-5806.


FilesAnywhere does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Amazon Flexible Payments Service (FPS) PHP Library does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to misinterpretation of a certain \true\ value.


The PayPal module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to use of the PHP fsockopen function.


The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA.


The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Trillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate a different vulnerability than CVE-2009-4831.


The Rackspace app 2.1.5 for iOS does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Sage Pay Direct module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Groupon Redemptions application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Breezy application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The client in FreeIPA 2.x and 3.x before 3.1.2 does not properly obtain the Certification Authority (CA) certificate from the server which allows man-in-the-middle attackers to spoof a join procedure via a crafted certificate.


The developer-account sample code in Google AdMob does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Apache Axis 1.4 and earlier as used in PayPal Payments Pro PayPal Mass Pay PayPal Transactional Information SOAP the Java Message Service implementation in Apache ActiveMQ and other products does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Authorize.Net eCheck module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Amazon merchant SDK does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate as demonstrated by a server used for updating virus signature files.


The Authorize.Net module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The PayPal Pro PayFlow EC module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.


The MoneyBookers module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Codehaus XFire 1.2.6 and earlier as used in the Amazon EC2 API Tools Java library and other products does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


PayPal Payments Standard PHP Library 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to misinterpretation of a certain TRUE value.


The PayPal IPN utility does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to use of the PHP fsockopen function.


Samsung Kies Air 2.1.207051 and 2.1.210161 relies on the IP address for authentication which allows remote man-in-the-middle attackers to read arbitrary phone contents by spoofing or controlling the IP address.


The Android_Pusher library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The contribution feature in Zamboni does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to use of the Python urllib2 library.


x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The PayPal Express module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


AOL Instant Messenger (AIM) 1.0.1.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


PayPal Invoicing does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The ACRA library for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


PayPal Payments Standard PHP Library before 20120427 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to intentional disabling of certificate-validation checks through a \FALSE\ value.


Open Source Classifieds does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to use of the PHP fsockopen function.


Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The PayPal Payments Pro module in Zen Cart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to use of the PHP fsockopen function a different vulnerability than CVE-2012-5805.


Amazon Elastic Load Balancing API Tools does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to overriding the default JDK X509TrustManager.


The Canada Post (aka CanadaPost) module in PrestaShop does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate related to use of the PHP fsockopen function.


The PayPal module in Ubercart does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The SSL configuration in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.x before 7.2.1.4 supports the MD5 hash algorithm which makes it easier for man-in-the-middle attackers to spoof servers and decrypt network traffic via a brute-force attack.


The client in Tryton 5.x before 5.0.1 tries to make a connection to the bus in cleartext instead of encrypted under certain circumstances in bus.py and jsonrpc.py. This connection attempt fails but it contains in the header the current session of the user. This session could then be stolen by a man-in-the-middle.


The int_x509_param_set_hosts function in lib/libcrypto/x509/x509_vpm.c in LibreSSL 2.7.0 before 2.7.1 does not support a certain special case of a zero name length which causes silent omission of hostname verification and consequently allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: the LibreSSL documentation indicates that this special case is supported but the BoringSSL documentation does not.


Improper restriction of communication channel to intended endpoints vulnerability in HTTP daemon in Synology SSL VPN Client before 1.2.4-0224 allows remote attackers to conduct man-in-the-middle attacks via a crafted payload.


It

is

possible

to

configure

Apache

CXF

to

use

the

com.sun.net.ssl

implementation

via

'System.setProperty(\java.protocol.handler.pkgs\

\com.sun.net.ssl.internal.www.protocol\);'.

When

this

system

property

is

set

CXF

uses

some

reflection

to

try

to

make

the

HostnameVerifier

work

with

the

old

com.sun.net.ssl.HostnameVerifier

interface.

However

the

default

HostnameVerifier

implementation

in

CXF

does

not

implement

the

method

in

this

interface

and

an

exception

is

thrown.

However

in

Apache

CXF

prior

to

and

the

exception

is

caught

in

the

reflection

code

and

not

properly

propagated.

What

this

means

is

that

if

you

are

using

the

com.sun.net.ssl

stack

with

CXF

an

error

with

TLS

hostname

verification

will

not

be

thrown

leaving

a

CXF

client

subject

to

man-in-the-middle

attacks.


DISPUTED

CertificatePinner.java

in

OkHttp

through

allows

man-in-the-middle

attackers

to

bypass

certificate

pinning

by

changing

SSLContext

and

the

boolean

values

while

hooking

the

application.

NOTE:

This

id

is

disputed

because

some

parties

don't

consider

this

is

a

vulnerability.

Their

rationale

can

be

found

in


A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9 6.0.0 and 6.0.1 are vulnerable by such attack under SSL Deep Inspection feature when CPx being used.


A plaintext recovery of encrypted messages or a Man-in-the-middle (MiTM) attack on RSA PKCS #1 v1.5 encryption may be possible without knowledge of the server's private key. Fortinet FortiOS 5.4.6 to 5.4.9 6.0.0 and 6.0.1 are vulnerable by such attack under VIP SSL feature when CPx being used.


Polycom VVX 500 and 601 devices 5.8.0.12848 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.


AudioCodes 440HD and 450HD devices 3.1.2.89 and earlier allows man-in-the-middle attackers to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.


Authentication Bypass by Spoofing vulnerability in ECOS System Management Appliance (aka SMA) 5.2.68 allows a man-in-the-middle attacker to compromise authentication keys and configurations via IP spoofing during \Easy Enrollment.\


Use of insufficiently random values vulnerability in SYNO.Encryption.GenRandomKey in Synology DiskStation Manager (DSM) before 6.2-23739 allows man-in-the-middle attackers to compromise non-HTTPS sessions via unspecified vectors.


Lack of administrator control over security vulnerability in client.cgi in Synology SSL VPN Client before 1.2.5-0226 allows remote attackers to conduct man-in-the-middle attacks via the (1) command (2) hostname or (3) port parameter.


Multiple +Message Apps (Softbank +Message App for Android prior to version 10.1.7 Softbank +Message App for iOS prior to version 1.1.23 NTT DOCOMO +Message App for Android prior to version 42.40.2800 NTT DOCOMO +Message App for iOS prior to version 1.1.23 KDDI +Message App for Android prior to version 1.0.6 and KDDI +Message App for iOS prior to version 1.1.23) do not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


A vulnerability in the implementation of Extensible Authentication Protocol over LAN (EAPOL) functionality in Cisco Small Business 100 Series Wireless Access Points and Cisco Small Business 300 Series Wireless Access Points could allow an unauthenticated adjacent attacker to force the downgrade of the encryption algorithm that is used between an authenticator (access point) and a supplicant (Wi-Fi client). The vulnerability is due to the improper processing of certain EAPOL messages that are received during the Wi-Fi handshake process. An attacker could exploit this vulnerability by establishing a man-in-the-middle position between a supplicant and an authenticator and manipulating an EAPOL message exchange to force usage of a WPA-TKIP cipher instead of the more secure AES-CCMP cipher. A successful exploit could allow the attacker to conduct subsequent cryptographic attacks which could lead to the disclosure of confidential information. Cisco Bug IDs: CSCvj29229.


The iRemoconWiFi App for Android version 4.1.7 and earlier does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


LINE for iOS version 7.1.3 to 7.1.5 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DHC Online Shop App for Android version 3.2.0 and earlier does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


An unvalidated software update vulnerability in Music Center for PC version 1.0.02 and earlier could allow a man-in-the-middle attacker to tamper with an update file and inject executable files.


The LINE MUSIC for Android version 3.1.0 to versions prior to 3.6.5 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


A vulnerability in the Zero Touch Provisioning feature of the Cisco SD-WAN Solution could allow an unauthenticated remote attacker to gain unauthorized access to sensitive data by using an invalid certificate. The vulnerability is due to insufficient certificate validation by the affected software. An attacker could exploit this vulnerability by supplying a crafted certificate to an affected device. A successful exploit could allow the attacker to conduct man-in-the-middle attacks to decrypt confidential information on user connections to the affected software.


When an SRX Series device is configured to use HTTP/HTTPS pass-through authentication services a client sending authentication credentials in the initial HTTP/HTTPS session is at risk that these credentials may be captured during follow-on HTTP/HTTPS requests by a malicious actor through a man-in-the-middle attack or by authentic servers subverted by malicious actors. FTP and Telnet pass-through authentication services are not affected. Affected releases are Juniper Networks SRX Series: 12.1X46 versions prior to 12.1X46-D67 on SRX Series; 12.3X48 versions prior to 12.3X48-D25 on SRX Series; 15.1X49 versions prior to 15.1X49-D35 on SRX Series.


The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The KINEPASS App for Android Ver 3.1.1 and earlier and for iOS Ver 3.1.2 and earlier do not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Intuit Lacerte 2017 for Windows in a client/server environment transfers the entire customer list in cleartext over SMB which allows attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors. The customer list contains each customer's full name social security number (SSN) address job title phone number Email address spouse's phone/Email address and other sensitive information. After the client software authenticates to the server database the server sends the customer list. There is no need for further exploitation as all sensitive data is exposed. This vulnerability was validated on Intuit Lacerte 2017 however older versions of Lacerte may be vulnerable.


Pivotal Spring AMQP 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6 expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.


PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate which might allow man-in-the-middle attackers to obtain interaction data.


The default cloud-init configuration in cloud-init 0.6.2 and newer included \ssh_deletekeys: 0\ disabling cloud-init's deletion of ssh host keys. In some environments this could lead to instances created by cloning a golden master or template system sharing ssh host keys and being able to impersonate one another or conduct man-in-the-middle attacks.


A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host as long as it was signed by a trusted CA.


A flaw was found in the way samba before 4.7.9 and 4.8.4 allowed the use of weak NTLMv1 authentication even when NTLMv1 was explicitly disabled. A man-in-the-middle attacker could use this flaw to read the credential and other details passed between the samba server and client.


Dell EMC iDRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to iDRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server.


IBM Security Guardium EcoSystem 10.5 does not validate or incorrectly validates a certificate.This weakness might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host or the software might be deceived into accepting spoofed data that appears to originate from a trusted host. IBM X-Force ID: 141417.


IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security under certain conditions. This could result in a downgrade of TLS protocol. A remote attacker could exploit this vulnerability to perform man-in-the-middle attacks. IBM X-Force ID: 147292.


Improper input validation bugs in DNSSEC validators components in Knot Resolver (prior version 1.5.2) allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.


Improper input validation bugs in DNSSEC validators components in PowerDNS version 4.1.0 allow attacker in man-in-the-middle position to deny existence of some data in DNS via packet replay.


brianleroux

tiny-json-http

version

all

versions

since

commit

(Oct

contains

a

Missing

SSL

certificate

validation

vulnerability

in

The

libraries

core

functionality

is

affected.

that

can

result

in

Exposes

the

user

to

man-in-the-middle

attacks.


Thomson Reuters UltraTax CS 2017 on Windows in a client/server configuration transfers customer records and bank account numbers in cleartext over SMBv2 which allows attackers to (1) obtain sensitive information by sniffing the network or (2) conduct man-in-the-middle (MITM) attacks via unspecified vectors. The customer record transferred in cleartext contains: Client ID Full Name Spouse's Full Name Social Security Number Spouse's Social Security Number Occupation Spouse's Occupation Daytime Phone Home Phone Tax Preparer Federal and State Taxes to File Bank Name Bank Account Number and possibly other sensitive information.


A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS RSR RSB MACH100 MACH1000 MACH4000 MS and OCTOPUS Classic Platform Switches. A cleartext transmission of sensitive information vulnerability in the web interface has been identified which may allow an attacker to obtain sensitive information through a successful man-in-the-middle attack.


An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS RSR RSB MACH100 MACH1000 MACH4000 MS and OCTOPUS Classic Platform Switches. An inadequate encryption strength vulnerability in the web interface has been identified which may allow an attacker to obtain sensitive information through a successful man-in-the-middle attack.


An issue was discovered in Flexense DiskBoss 8.8.16 and earlier. Due to the usage of plaintext information from the handshake as input for the encryption key used for the encryption of the rest of the session the server and client disclose sensitive information such as the authentication credentials to any man-in-the-middle (MiTM) listener.


OnCommand Unified Manager for 7-Mode (core package) prior to 5.2.4 uses cookies that lack the secure attribute in certain circumstances making it vulnerable to impersonation via man-in-the-middle (MITM) attacks.


The PrinterLogic Print Management software versions up to and including 18.3.1.96 does not validate or incorrectly validates the PrinterLogic management portal's SSL certificate. When a certificate is invalid or malicious it might allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. The software might connect to a malicious host while believing it is a trusted host or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.


A man-in-the-middle vulnerability related to vCenter access was found in Rubrik CDM 3.x and 4.x before 4.0.4-p2. This vulnerability might expose Rubrik user credentials configured to access vCenter as Rubrik clusters did not verify TLS certificates presented by vCenter.


A vulnerability has been identified in Siveillance VMS Video for Android (All versions < V12.1a (2018 R1)) Siveillance VMS Video for iOS (All versions < V12.1a (2018 R1)). Improper certificate validation could allow an attacker in a privileged network position to read data from and write data to the encrypted communication channel between the app and a server. The security vulnerability could be exploited by an attacker in a privileged network position which allows intercepting the communication channel between the affected app and a server (such as Man-in-the-Middle). Furthermore an attacker must be able to generate a certificate that results for the validation algorithm in a checksum identical to a trusted certificate. Successful exploitation requires no user interaction. The vulnerability could allow reading data from and writing data to the encrypted communication channel between the app and a server impacting the communication's confidentiality and integrity. At the time of advisory publication no public exploitation of this security vulnerability was known. Siemens confirms the security vulnerability and provides mitigations to resolve the security issue.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the \Mail\ component. It allows man-in-the-middle attackers to read S/MIME encrypted messages by leveraging an inconsistency in the user interface.


An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the \iBooks\ component. It allows man-in-the-middle attackers to spoof a password prompt.


An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the \Mail\ component. It allows man-in-the-middle attackers to read S/MIME encrypted message content by sending HTML e-mail that references remote resources but lacks a valid S/MIME signature.


Dell Networking OS10 versions prior to 10.4.3.0 contain a vulnerability in the Phone Home feature which does not properly validate the server's certificate authority during TLS handshake. Use of an invalid or malicious certificate could potentially allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.


The Subsonic Music Streamer application 4.4 for Android has Improper Certificate Validation of the Subsonic server certificate which might allow man-in-the-middle attackers to obtain interaction data.


An issue was discovered in myStrom WiFi Switch V1 before 2.66 WiFi Switch V2 before 3.80 WiFi Switch EU before 3.80 WiFi Bulb before 2.58 WiFi LED Strip before 3.80 WiFi Button before 2.73 and WiFi Button Plus before 2.73. The SSL/TLS server certificate in the device to cloud communication was not verified by the device. As a result an attacker in control of the network traffic of a device could have taken control of a device by intercepting and modifying commands issued from the server to the device in a Man-in-the-Middle attack. This included the ability to inject firmware update commands into the communication and cause the device to install maliciously modified firmware.


An issue was discovered in the MensaMax (aka com.breustedt.mensamax) application 4.3 for Android. Cleartext Transmission of Sensitive Information allows man-in-the-middle attackers to eavesdrop authentication information between the application and the server.


An information-disclosure issue was discovered in Postman through 6.3.0. It validates a server's X.509 certificate and presents an error if the certificate is not valid. Unfortunately the associated HTTPS request data is sent anyway. Only the response is not displayed. Thus all contained information of the HTTPS request is disclosed to a man-in-the-middle attacker (for example user credentials).


NVIDIA GeForce Experience all versions prior to 3.14.1 contains a potential vulnerability during GameStream installation where an attacker who has system access can potentially conduct a Man-in-the-Middle (MitM) attack to obtain sensitive information.


SSH host keys generation vulnerability in the server in McAfee Threat Intelligence Exchange Server (TIE Server) 1.3.0 2.0.x 2.1.x 2.2.0 allows man-in-the-middle attackers to spoof servers via acquiring keys from another environment.


An unvalidated software update vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a man-in-the-middle attacker to tamper with an update file and inject their own.


Samsung Display Solutions App before 3.02 for Android allows man-in-the-middle attackers to spoof B2B content by leveraging failure to use encryption during information transmission.


ffxivlauncher.exe in Square Enix Final Fantasy XIV 4.21 and 4.25 on Windows is affected by Improper Enforcement of Message Integrity During Transmission in a Communication Channel allowing a man-in-the-middle attacker to steal user credentials because a session retrieves global.js via http before proceeding to use https. This is fixed in Patch 4.3.


There is an anonymous TLS cipher suites supported vulnerability in Huawei eSpace product. An unauthenticated remote attacker launches man-in-the-middle attack to hijack the connection from a client when the user signs up to log in by TLS. Due to insufficient authentication which may be exploited to intercept and tamper with the data information.


There is a short key vulnerability in Huawei eSpace product. An unauthenticated remote attacker launches man-in-the-middle attack to intercept and decrypt the call information when the user enables SRTP to make a call. Successful exploitation may cause sensitive information leak.


There is a SRTP icon display vulnerability in Huawei eSpace product. An unauthenticated remote attacker launches man-in-the-middle attack to intercept the packets in non-secure transmission mode. Successful exploitation may intercept and tamper with the call information eventually cause sensitive information leak.


An issue was discovered in iDashboards 9.6b. The SSO implementation is affected by a weak obfuscation library allowing man-in-the-middle attackers to discover credentials.


The Mizuho Direct App for Android version 3.13.0 and earlier does not verify server certificates which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Missing message authentication in the meta-protocol in Tinc VPN version 1.0.34 and earlier allows a man-in-the-middle attack to disable the encryption of VPN packets.


The

RICOH

Interactive

Whiteboard

to

to

to

the

display

versions

with

RICOH

Interactive

Whiteboard

Controller

to

attached

and

the

display

versions

with

RICOH

Interactive

Whiteboard

Controller

to

attached

does

not

verify

its

server

certificates

which

allows

man-in-the-middle

attackers

to

eversdrop

on

encrypted

communication.


In VOS compromised an attacker at network endpoints can possibly view communications between an unsuspecting user and the service using man-in-the-middle attacks. Usage of unapproved SSH encryption protocols or cipher suites also violates the Data Protection TSR (Technical Security Requirements).


UCWeb UC 12.12.3.1219 through 12.12.3.1226 uses cleartext HTTP and thus man-in-the-middle attackers can discover visited URLs.


Missing validation of server certificates for out-going connections in Nextcloud Social < 0.4.0 allowed a man-in-the-middle attack.


In the Voatz application 2020-01-01 for Android the amount of data transmitted during a single voter's vote depends on the different lengths of the metadata across the available voting choices which makes it easier for remote attackers to discover this voter's choice by sniffing the network. For example a small amount of sniffed data may indicate that a vote was cast for the candidate with the least metadata. An active man-in-the-middle attacker can leverage this behavior to disrupt voters' abilities to vote for a candidate opposed by the attacker.


An issue was discovered in Zoho ManageEngine AssetExplorer 6.5. During an upgrade of the Windows agent it does not validate the source and binary downloaded. This allows an attacker on an adjacent network to execute code with NT AUTHORITY/SYSTEM privileges on the agent machines by providing an arbitrary executable via a man-in-the-middle attack.


Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those) this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters) this can lead to code execution when combined with CVE-2020-8810.


Avast AntiTrack before 1.5.1.172 and AVG Antitrack before 2.0.0.178 proxies traffic to HTTPS sites but does not validate certificates and thus a man-in-the-middle can host a malicious website using a self-signed certificate. No special action necessary by the victim using AntiTrack with \Allow filtering of HTTPS traffic for tracking detection\ enabled. (This is the default configuration.)


PHOENIX CONTACT TC ROUTER 3002T-4G through 2.05.3 TC ROUTER 2002T-3G through 2.05.3 TC ROUTER 3002T-4G VZW through 2.05.3 TC ROUTER 3002T-4G ATT through 2.05.3 TC CLOUD CLIENT 1002-4G through 2.03.17 and TC CLOUD CLIENT 1002-TXTX through 1.03.17 devices contain a hardcoded certificate (and key) that is used by default for web-based services on the device. Impersonation man-in-the-middle or passive decryption attacks are possible if the generic certificate is not replaced by a device-specific certificate during installation.


HUAWEI P30;HUAWEI P30 Pro;Tony-AL00B smartphones with versions earlier than 10.1.0.135(C00E135R2P11); versions earlier than 10.1.0.135(C00E135R2P8) versions earlier than 10.1.0.135 have an improper authentication vulnerability. Due to the identity of the message sender not being properly verified an attacker can exploit this vulnerability through man-in-the-middle attack to induce user to access malicious URL.


Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1


CS2 Network P2P through 3.x as used in millions of Internet of Things devices suffers from an authentication flaw that allows remote attackers to perform a man-in-the-middle attack as demonstrated by eavesdropping on user video/audio streams capturing credentials and compromising devices.


TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.


In voloko twitter-stream 0.1.10 missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused).


In

mainwindow.cpp

in

Shotcut

before

the

upgrade

check

misuses

TLS

because

of

setPeerVerifyMode(QSslSocket::VerifyNone).

A

man-in-the-middle

attacker

could

offer

a

spoofed

download

resource.


A flaw was found in PostgreSQL versions before 13.1 before 12.5 before 11.10 before 10.15 before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters an opportunity for a man-in-the-middle attack or the ability to observe clear-text transmissions could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.


The NPort IA5000A Series devices use Telnet as one of the network device management services. Telnet does not support the encryption of client-server communications making it vulnerable to Man-in-the-Middle attacks.


Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.


Improper certificate validation vulnerability in OpenVPN client in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Improper certificate validation vulnerability in OpenVPN client in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-middle attacker to identify the Passkey used during pairing (in the Passkey authentication procedure) by reflection of the public key and the authentication evidence of the initiating device potentially permitting this attacker to complete authenticated pairing with the responding device using the correct Passkey for the pairing session. The attack methodology determines the Passkey value one bit at a time.


Opencast before versions 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks. This problem is fixed in Opencast 7.9 and Opencast 8.8 Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those please make sure to import them into the Java key store. Better yet get a valid certificate.


Improper certificate validation for certain connections in the Bosch Smart Home System App for iOS prior to version 9.17.1 potentially allows to intercept video contents by performing a man-in-the-middle attack.


A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists in Schneider Electric Software Update (SESU) V2.4.0 and prior which could cause execution of malicious code on the victim's machine. In order to exploit this vulnerability an attacker requires privileged access on the engineering workstation to modify a Windows registry key which would divert all traffic updates to go through a server in the attacker's possession. A man-in-the-middle attack is then used to complete the exploit.


Parallels 13 uses cleartext HTTP as part of the update process allowing man-in-the-middle attacks. Users of out-of-date versions are presented with a pop-up window for a parallels_updates.xml file on the http://update.parallels.com web site.


An issue was discovered in OpenWrt 18.06.0 to 18.06.6 and 19.07.0 and LEDE 17.01.0 to 17.01.7. A bug in the fork of the opkg package manager before 2020-01-25 prevents correct parsing of embedded checksums in the signed repository index allowing a man-in-the-middle attacker to inject arbitrary package payloads (which are installed without verification).


A flaw was found in rsync in versions since 3.2.0pre1. Rsync improperly validates certificate with host mismatch vulnerability. A remote unauthenticated attacker could exploit the flaw by performing a man-in-the-middle attack using a valid certificate for another hostname which could compromise confidentiality and integrity of data transmitted using rsync-ssl. The highest threat from this vulnerability is to data confidentiality and integrity. This flaw affects rsync versions before 3.2.4.


PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).


Mutt before 1.14.4 and NeoMutt before 2020-06-19 have a STARTTLS buffering issue that affects IMAP SMTP and POP3. When a server sends a \begin TLS\ response the client reads additional data (e.g. from a man-in-the-middle attacker) and evaluates it in a TLS context aka \response injection.\


Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response.


The email client in Jira Server and Data Center before version 7.13.16 from 8.5.0 before 8.5.7 from 8.8.0 before 8.8.2 and from 8.9.0 before 8.9.1 allows remote attackers to access outgoing emails between a Jira instance and the SMTP server via man-in-the-middle (MITM) vulnerability.


The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.


Atlassian Bitbucket Server from version 4.9.0 before version 7.2.4 allows remote attackers to intercept unencrypted repository import requests via a Man-in-the-Middle (MITM) attack.


Android App 'Mercari' (Japan version) prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView.


Nessus AMI versions 8.12.0 and earlier were found to either not validate or incorrectly validate a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack.


Android App 'MyPallete' and some of the Android banking applications based on 'MyPallete' do not verify X.509 certificates from servers and also do not properly validate certificates with host-mismatch which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The AWMS Mobile App for Android 2.0.0 to 2.0.5 and for iOS 2.0.0 to 2.0.8 does not verify X.509 certificates from servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The kantan netprint App for Android 2.0.3 and earlier does not verify X.509 certificates from servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.


In versions 15.0.0-15.1.0.1 14.1.0-14.1.2.3 13.1.0-13.1.3.4 12.1.0-12.1.5.1 and 11.6.1-11.6.5.2 the BIG-IP Client or Server SSL profile ignores revoked certificates even when a valid CRL is present. This impacts SSL/TLS connections and may result in a man-in-the-middle attack on the connections.


The netprint App for iOS 3.2.3 and earlier does not verify X.509 certificates from servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The kantan netprint App for iOS 2.0.2 and earlier does not verify X.509 certificates from servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The IBM Spectrum Protect Plus 10.1.0.0 through 10.1.8.x server connection to an IBM Spectrum Protect Plus workload agent is subject to a man-in-the-middle attack due to improper certificate validation. IBM X-Force ID: 182046.


Devices supporting Bluetooth before 5.1 may allow man-in-the-middle attacks aka BLURtooth. Cross Transport Key Derivation in Bluetooth Core Specification v4.2 and v5.0 may permit an unauthenticated user to establish a bonding with one transport either LE or BR/EDR and replace a bonding already established on the opposing transport BR/EDR or LE potentially overwriting an authenticated key with an unauthenticated key or a key with greater entropy with one with less.


An issue was discovered on Dr Trust ECG Pen 2.00.08 devices. Because the Bluetooth LE support is implemented without a requirement for pairing or security any attacker can access the GATT server of the device and can sniff the data being broadcasted while a measurement is being done. Also saved data can also be extracted over a Bluetooth connection. In addition an attacker can launch a man-in-the-middle attack against data integrity.


In faye-websocket before version 0.11.0 there is a lack of certification validation in TLS handshakes. The `Faye::WebSocket::Client` class uses the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `wss:` connection made using this library is vulnerable to a man-in-the-middle attack since it does not confirm the identity of the server it is connected to. For further background information on this issue please see the referenced GitHub Advisory. Upgrading `faye-websocket` to v0.11.0 is recommended.


In Redgate SQL Monitor 7.1.4 through 10.1.6 (inclusive) the scope for disabling some TLS security certificate checks can extend beyond that defined by various options on the Configuration > Notifications pages to disable certificate checking for alert notifications. These TLS security checks are also ignored during monitoring of VMware machines. This would make SQL Monitor vulnerable to potential man-in-the-middle attacks when sending alert notification emails posting to Slack or posting to webhooks. The vulnerability is fixed in version 10.1.7.


MSA/SMTP.cpp in Trojita before 0.8 ignores certificate-verification errors which allows man-in-the-middle attackers to spoof SMTP servers.


The host SSH servers of Brocade Fabric OS before Brocade Fabric OS v7.4.2h v8.2.1c v8.2.2 v9.0.0 and Brocade SANnav before v2.1.1 utilize keys of less than 2048 bits which may be vulnerable to man-in-the-middle attacks and/or insecure SSH communications.


PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP SDP RTP STUN TURN and ICE. In version 2.10 and earlier PJSIP transport can be reused if they have the same IP address + port + protocol. However this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com` which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname say `sip.bar.com` which has the same IP address then it will reuse that existing connection even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing.


Faye before version 1.4.0 there is a lack of certification validation in TLS handshakes. Faye uses em-http-request and faye-websocket in the Ruby version of its client. Those libraries both use the `EM::Connection#start_tls` method in EventMachine to implement the TLS handshake whenever a `wss:` URL is used for the connection. This method does not implement certificate verification by default meaning that it does not check that the server presents a valid and trusted TLS certificate for the expected hostname. That means that any `https:` or `wss:` connection made using these libraries is vulnerable to a man-in-the-middle attack since it does not confirm the identity of the server it is connected to. The first request a Faye client makes is always sent via normal HTTP but later messages may be sent via WebSocket. Therefore it is vulnerable to the same problem that these underlying libraries are and we needed both libraries to support TLS verification before Faye could claim to do the same. Your client would still be insecure if its initial HTTPS request was verified but later WebSocket connections were not. This is fixed in Faye v1.4.0 which enables verification by default. For further background information on this issue please see the referenced GitHub Advisory.


The RSS application on THOMSON THT741FTA 2.2.1 and Philips DTR3502BFTA DVB-T2 2.2.1 set-top boxes doesn't validate the SSL certificates of RSS servers which allows a man-in-the-middle attacker to modify the data delivered to the client.


Mids' Reborn Hero Designer 2.6.0.7 downloads the update manifest as well as update files over cleartext HTTP. Additionally the application does not perform file integrity validation for files after download. An attacker can perform a man-in-the-middle attack against this connection and replace executable files with malicious versions which the operating system then executes under the context of the user running Hero Designer.


In Moonlight iOS/tvOS before 4.0.1 the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.0.1 for iOS and tvOS.


An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57 V1600D4L V1.01.49 V1600D-MINI V1.01.48 V1600G1 V2.0.7 and V1.9.7 and V1600G2 V1.1.4 OLT devices. TELNET is offered by default but SSH is not always available. An attacker can intercept passwords sent in cleartext and conduct a man-in-the-middle attack on the management of the appliance.


An

issue

was

discovered

on

CDATA

and

devices.

By

default

the

appliance

can

be

managed

remotely

only

with

HTTP

telnet

and

SNMP.

It

doesn't

support

SSL/TLS

for

HTTP

or

SSH.

An

attacker

can

intercept

passwords

sent

in

cleartext

and

conduct

man-in-the-middle

attacks

on

the

management

of

the

appliance.


A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5) SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). Devices create a new unique key upon factory reset except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.


A vulnerability has been identified in SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.


TerraMaster TOS <= 4.2.06 was found to check for updates (of both system and applications) via an insecure channel (HTTP). Man-in-the-middle attackers are able to intercept these requests and serve a weaponized/infected version of applications or updates.


With MariaDB running on Windows when local clients connect to the server over named pipes it's possible for an unprivileged user with an ability to run code on the server machine to intercept the named pipe connection and act as a man-in-the-middle gaining access to all the data passed between the client and the server and getting the ability to run SQL commands on behalf of the connected user. This occurs because of an incorrect security descriptor. This affects MariaDB Server before 10.1.48 10.2.x before 10.2.35 10.3.x before 10.3.26 10.4.x before 10.4.16 and 10.5.x before 10.5.7. NOTE: this issue exists because certain details of the MariaDB CVE-2019-2503 fix did not comprehensively address attack variants against MariaDB. This situation is specific to MariaDB and thus CVE-2020-28912 does NOT apply to other vendors that were originally affected by CVE-2019-2503.


A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker able to man-in-the-middle the connection between the user's browser and the openshift console could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.


A vulnerability in Apache Flink (1.1.0 to 1.1.5 1.2.0 to 1.2.1 1.3.0 to 1.3.3 1.4.0 to 1.4.2 1.5.0 to 1.5.6 1.6.0 to 1.6.4 1.7.0 to 1.7.2 1.8.0 to 1.8.3 1.9.0 to 1.9.2 1.10.0) where when running a process with an enabled JMXReporter with a port configured via metrics.reporter.reporter_name>.port an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind the JMXRMI registry to one under the attacker's control. This compromises any connection established to the process via JMX allowing extraction of credentials and any other transferred data.


A vulnerability has been identified in SICAM MMU (All versions < V2.05) SICAM SGU (All versions) SICAM T (All versions < V2.18). An attacker in a privileged network position between a legitimate user and the web server might be able to conduct a Man-in-the-middle attack and gain read and write access to the transmitted data.


A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6 that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers to redirect traffic to the malicious container.


A vulnerability in the hardware crypto driver of Cisco IOS XE Software for Cisco 4300 Series Integrated Services Routers and Cisco Catalyst 9800-L Wireless Controllers could allow an unauthenticated remote attacker to disconnect legitimate IPsec VPN sessions to an affected device. The vulnerability is due to insufficient verification of authenticity of received Encapsulating Security Payload (ESP) packets. An attacker could exploit this vulnerability by tampering with ESP cleartext values as a man-in-the-middle.


A vulnerability in the sftunnel functionality of Cisco Firepower Management Center (FMC) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to obtain the device registration hash. The vulnerability is due to insufficient sftunnel negotiation protection during initial device registration. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a specific flow of the sftunnel communication between an FMC device and an FTD device. A successful exploit could allow the attacker to decrypt and modify the sftunnel communication between FMC and FTD devices allowing the attacker to modify configuration data sent from an FMC device to an FTD device or alert data sent from an FTD device to an FMC device.


MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.


eM Client before 7.2.33412.0 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.


An issue was discovered in CipherMail Community Gateway Virtual Appliances and Professional/Enterprise Gateway Virtual Appliances versions 1.0.1 through 4.7.1-0 and CipherMail Webmail Messenger Virtual Appliances 1.1.1 through 3.1.1-0. A Diffie-Hellman parameter of insufficient size could allow man-in-the-middle compromise of communications between CipherMail products and external SMTP clients.


Sigma Spectrum Infusion System v's6.x (model 35700BAX) and Baxter Spectrum Infusion System Version(s) 8.x (model 35700BAX2) at the application layer uses an unauthenticated clear-text communication channel to send and receive system status and operational data. This could allow an attacker that has circumvented network security measures to view sensitive non-private data or to perform a man-in-the-middle attack.


OpenConnect through 8.08 mishandles negative return values from X509_check_ function calls which might assist attackers in performing man-in-the-middle attacks.


In Apache Cassandra all versions prior to 2.1.22 2.2.18 3.0.22 3.11.8 and 4.0-beta2 it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684 a JRE vulnerability that enables this issue to be exploited remotely.


EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.


HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses internally this method to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards the hostname verification will be performed using the default JVM truststore.


em-imap 0.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.


Jenkins Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed certificates and does not perform hostname validation enabling man-in-the-middle attacks.


An authentication bypass by spoofing vulnerability exists in the authentication daemon and User-ID components of Palo Alto Networks PAN-OS by failing to verify the integrity of the Kerberos key distribution center (KDC) before authenticating users. This affects all forms of authentication that use a Kerberos authentication profile. A man-in-the-middle type of attacker with the ability to intercept communication between PAN-OS and KDC can login to PAN-OS as an administrator. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All version of PAN-OS 8.0.


When the pre-logon feature is enabled a missing certification validation in Palo Alto Networks GlobalProtect app can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or to conduct ARP spoofing attacks. This allows the attacker to access the GlobalProtect Server as allowed by configured Security rules for the 'pre-login' user. This access may be limited compared to the network access of regular users. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 when the prelogon feature is enabled; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 when the prelogon feature is enabled.


Jenkins Mac Plugin 1.1.0 and earlier does not validate SSH host keys when connecting agents created by the plugin enabling man-in-the-middle attacks.


Jenkins Amazon EC2 Plugin 1.50.1 and earlier does not validate SSH host keys when connecting agents enabling man-in-the-middle attacks.


Add-on updates failed to verify that the add-on ID inside the signed package matched the ID of the add-on being updated. An attacker who could perform a man-in-the-middle attack on the user's connection to the update server and defeat the certificate pinning protection could provide a malicious signed add-on instead of a valid update. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.


The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0 when built for Windows CE using the schannel TLS backend makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate as demonstrated by \*.com.\


Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them in certain configurations to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration so the security impact of this vulnerability is low.


An issue was discovered in Smiths-Medical CADD-Solis Medication Safety Software Version 1.0; 2.0; 3.0; and 3.1. The affected software does not verify the identities at communication endpoints which may allow a man-in-the-middle attacker to gain access to the communication channel between endpoints.


An improper certificate validation vulnerability in Fortinet FortiManager 5.0.6 through 5.2.7 and 5.4.0 through 5.4.1 allows remote attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack via the Fortisandbox devices probing feature.


An issue has been found in PowerDNS before 3.4.11 and 4.0.2 and PowerDNS recursor before 4.0.4 allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check that the TSIG record is the last one leading to the possibility of parsing records that are not covered by the TSIG signature.


The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The tls.checkServerIdentity function in Node.js 0.10.x before 0.10.47 0.12.x before 0.12.16 4.x before 4.6.0 and 6.x before 6.7.0 does not properly handle wildcards in name fields of X.509 certificates which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. The issue involves the \CFNetwork Proxies\ component which allows man-in-the-middle attackers to spoof a proxy password authentication requirement and obtain sensitive information.


The Bank of Tokyo-Mitsubishi UFJ Ltd. App for Android ver5.3.1 ver5.2.2 and earlier allow a man-in-the-middle attacker to downgrade the communication between the app and the server from TLS v1.2 to SSL v3.0 which may result in the attacker to eavesdrop on an encrypted communication.


The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


An issue has been found in PowerDNS before 3.4.11 and 4.0.2 and PowerDNS recursor before 4.0.4 allowing an attacker in position of man-in-the-middle to alter the content of an AXFR because of insufficient validation of TSIG signatures. A missing check of the TSIG time and fudge values was found in AXFRRetriever leading to a possible replay attack.


An issue was discovered in the portaudio crate through 0.7.0 for Rust. There is a man-in-the-middle issue because the source code is downloaded over cleartext HTTP.


The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.


The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS app features.


An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnerability because hostname verification was omitted.


D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key which allows man-in-the-middle attackers to spoof devices by hijacking an HTTPS session.


An issue was discovered in the openssl crate before 0.9.0 for Rust. There is an SSL/TLS man-in-the-middle vulnerability because certificate verification is off by default and there is no API for hostname verification.


lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.


The Bzrtp library (aka libbzrtp) 1.0.x before 1.0.4 allows man-in-the-middle attackers to conduct spoofing attacks by leveraging a missing HVI check on DHPart2 packet reception.


The Cisco Application-hosting Framework (CAF) component in Cisco IOS 15.6(1)T1 and IOS XE when the IOx feature set is enabled allows man-in-the-middle attackers to trigger arbitrary downloads via crafted HTTP headers aka Bug ID CSCuz84773.


The Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to obtain sensitive information via an HTTP method that is neither GET nor POST.


Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents.


A security bypass vulnerability exists in Symantec Norton Mobile Security for Android before 3.16 which could let a malicious user conduct a man-in-the-middle via specially crafted JavaScript to add arbitrary URLs to the URL whitelist.


** DISPUTED ** Citrix XenMobile Server before 10.5.0.24 allows man-in-the-middle attackers to trigger HTTP 302 redirections via vectors involving the HTTP Host header and a cached page. NOTE: the vendor reports \our internal analysis of this issue concluded that this was not a valid vulnerability\ because an exploitation scenario would involve a man-in-the-middle attack against a TLS session.


Kaspersky Safe Browser iOS before 1.7.0 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.


The U by BB&T app 1.5.4 and earlier for iOS does not properly verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.


The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates.


Insufficient validation of SSH keys in Junos Space before 15.2R2 allows man-in-the-middle (MITM) type of attacks while a Space device is communicating with managed devices.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. The issue involves the \IDS - Connectivity\ component which allows man-in-the-middle attackers to spoof calls via a \switch caller\ notification.


WKWebView in WebKit in Apple iOS before 10 iTunes before 12.5.1 on Windows and Safari before 10 does not properly verify X.509 certificates from HTTPS servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The NTT Broadband Platform Japan Connected-free Wi-Fi application 1.15.1 and earlier for Android and 1.13.0 and earlier for iOS allows man-in-the-middle attackers to obtain API access via unspecified vectors.


OpenNTPD before 6.0p1 does not validate the CN for HTTPS constraint requests which allows remote attackers to bypass the man-in-the-middle mitigations via a crafted timestamp constraint with a valid certificate.


Intel Crosswalk before 19.49.514.5 20.x before 20.50.533.11 21.x before 21.51.546.0 and 22.x before 22.51.549.0 interprets a user's acceptance of one invalid X.509 certificate to mean that all invalid X.509 certificates should be accepted without prompting which makes it easier for man-in-the-middle attackers to spoof SSL servers and obtain sensitive information via a crafted certificate.


Google Chrome before 52.0.2743.82 mishandles origin information during proxy authentication which allows man-in-the-middle attackers to spoof a proxy-authentication login prompt or trigger incorrect credential storage by modifying the client-server data stream.


Misys FusionCapital Opics Plus allows remote authenticated users to gain privileges via a man-in-the-middle attack that modifies the xmlMessageOut parameter.


Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.


NetApp Virtual Storage Console for VMware vSphere before 6.2.1 uses a non-unique certificate which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.


Crestron Electronics DM-TXRX-100-STR devices with firmware before 1.3039.00040 use a hardcoded 0xb9eed4d955a59eb3 X.509 certificate from an OpenSSL Test Certification Authority which makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions by leveraging the certificate's trust relationship.


Misys FusionCapital Opics Plus does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.