man-in-the-middle vulnerabilities and exploits

(subscribe to this query)

A potential Man-in-the-Middle (MitM) attack vulnerability in Trend Micro OfficeScan 11.0 and XG may allow malicious users to execute arbitrary code on vulnerable installations.

Trendmicro Officescan 12.0 Trendmicro Officescan 11.0

1 EDB exploit1 Github repository

Symantec Backup Exec 11.0, 12.0, 12.5, 13.0, and 13.0 R2 does not validate identity information sent between the media server and the remote agent, which allows man-in-the-middle malicious users to execute NDMP commands via unspecified vectors.

Symantec Backup Exec 11.0 Symantec Backup Exec 13.0 Symantec Backup Exec 12.0 Symantec Backup Exec 12.5

1 EDB exploit

pip prior to 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle malicious users to execute arbitrary code via a crafted response to a "pip install" operation.

Intel Driver Update Utility prior to 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle malicious users to execute arbitrary code via a crafted file.

Intel Driver Update Utility 2.2 Intel Driver Update Utility 2.0 Intel Driver Update Utility 2.1 Intel Driver Update Utility 2.3

Intel Driver Update Utility version 2.2.0.5 suffers from a man-in-the-middle vulnerability..

AudioCodes 440HD and 450HD devices 3.1.2.89 and previous versions allows man-in-the-middle malicious users to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

Audiocodes 440hd Firmware Audiocodes 450hd Firmware

Polycom VVX 500 and 601 devices 5.8.0.12848 and previous versions allows man-in-the-middle malicious users to obtain sensitive credential information by leveraging failure to validate X.509 certificates when used with an on-premise installation with Skype for Business.

Polycom Unified Communications Software Polycom Vvx 601 Firmware -Polycom Vvx 500 Firmware -

The fabric-interconnect component in Cisco Unified Computing System (UCS) does not properly verify X.509 certificates, which allows man-in-the-middle malicious users to watch SSL KVM video-channel traffic or modify this traffic via a crafted certificate, aka Bug ID CSCtr73033.

Cisco Unified Computing System -

The fabric-interconnect KVM module in Cisco Unified Computing System (UCS) does not encrypt video data, which allows man-in-the-middle malicious users to watch KVM display content by sniffing the network or modify this traffic by inserting packets into the client-server data stre...

Cisco Unified Computing System -

The Integrated Management Controller on Cisco Unified Computing System (UCS) C servers with software 1.5(3) and 1.6(0.16) has a default SSL certificate, which makes it easier for man-in-the-middle malicious users to bypass cryptographic protection mechanisms by leveraging knowled...

Cisco Unified Computing System 1.6(0.16)Cisco Unified Computing System 1.5(3)

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook