man-in-the-middle vulnerabilities and exploits

(subscribe to this query)

935

VMScore

The SaveDoc method in the All_In_The_Box.AllBox ActiveX control in ALL_IN_THE_BOX.OCX in Synactis ALL In-The-Box ActiveX 3 allows remote attackers to create and overwrite arbitrary files via an argument ending in a '\0' character, which bypasses the intended .box...

Synactis All In The Box.ocx 31 EDB exploit available

668

VMScore

I-Man 0.9, and possibly earlier versions, allows remote attackers to execute arbitrary PHP code by uploading a file attachment with a .php extension....

I-man I-man 0.2 I-man I-man 0.3 I-man I-man 0.4 I-man I-man 0.5 I-man I-man 0.6 I-man I-man 0.7 I-man I-man 0.8 I-man I-man 0.9

481

VMScore

The Revel in the Rideau Lakes (aka com.mytoursapp.android.app326) application 1.0.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate....

Mytoursapp Revel In The Rideau Lakes 1.0.6

465

VMScore

man before 1.5l allows attackers to execute arbitrary code via a malformed man file with improper quotes, which causes the my_xsprintf function to return a string with the value "unsafe," which is then executed as a program via a system call if it is in the search path...

Andries Brouwer Man 1.5h1 Andries Brouwer Man 1.5i Andries Brouwer Man 1.5i2 Andries Brouwer Man 1.5j Andries Brouwer Man 1.5k1 EDB exploit available

465

VMScore

Multiple buffer overflows in man-db 2.4.1 and earlier, when installed setuid, allow local users to gain privileges via (1) MANDATORY_MANPATH, MANPATH_MAP, and MANDB_MAP arguments to add_to_dirlist in manp.c, (2) a long pathname to ult_src in ult_src.c, (3) a long .so argument to...

Andries Brouwer Man 2.3.18 Andries Brouwer Man 2.3.19 Andries Brouwer Man 2.3.20 Andries Brouwer Man 2.4 Andries Brouwer Man 2.4.11 EDB exploit available

383

VMScore

translate man before 2018-08-21 has XSS via containers/outputBox/outputBox.vue and store/index.js....

Translate Man Project Translate Man

445

VMScore

man-cgi before 1.16 allows Local File Inclusion via absolute path traversal, as demonstrated by a cgi-bin/man-cgi?/etc/passwd URI....

Man-cgi Project Man-cgi

725

VMScore

The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in Ubuntu and Debian allows local users with access to the man account to gain privileges via vectors involving insecure chown use....

Man-db Project Man-db1 EDB exploit available

435

VMScore

Cross-site scripting (XSS) vulnerability in index.php AbleDesign D-Man 3.x allows remote attackers to inject arbitrary web script or HTML via the title parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information....

Abledesign D-man 3.01 EDB exploit available

465

VMScore

man-db 2.3.12 and 2.3.18 to 2.4.1 uses certain user-controlled DEFINE directives from the ~/.manpath file, even when running setuid, which could allow local users to gain privileges....

Andries Brouwer Man 2.3.20 Andries Brouwer Man 2.4.11 EDB exploit available

1 2 3 4 5 NEXT »