CWE-300: Channel Accessible by Non-Endpoint
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
Also known as Adversary-in-the-Middle / AITM, Attacker-in-the-Middle / AITM, Man-in-the-Middle / MITM.
A kind of CWE-923 Improper Restriction of Communication Channel to Intended Endpoints.
From the CWE List. © The MITRE Corporation.
Newest
- mikrotik winbox, routeros +1 moreMikroTik Winbox 3.20 and below is vulnerable to man in the middle attacks. A man in the middle...3.7 Low
- apple macos, freebsd, itop vpn +6 more +8 moreA vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a...7.4 High
- jenkins google compute engine, jenkins project google compute engine plugin +1 moreJenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin5.9 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: An attacker may be able to perform Man-in-the-Middle (MitM) attacks during app-id signature updates.6.8 Medium
- ui unifi controller, unifi +1 moreSMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi...8.1 High
- gemalto sentinel ldkGemalto Admin Control Center, all versions prior to 7.92, uses cleartext HTTP to communicate with...5.3 Medium
- pivotal apps manager, pivotal software application service +1 moreInvitations Service supports HTTP connections8.1 High
- synology android moments, moments +1 moreChannel accessible by non-endpoint vulnerability in privacy page in Synology Android Moments...4.2 Medium
- openstack neutron, the openstack project openstack-neutron +1 moreOpenstack Neutron vulnerable to eavesdropping on private traffic5.3 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User Authentication6.1 Medium
- https-proxy-agent project https-proxy-agent, hackerone https-proxy-agent node module +1 moreDenial of Service in https-proxy-agent9.1 Critical
- socket engine.io-client, hackerone engine.io-client node module +1 moreInsecure Defaults Allow MITM Over TLS in engine.io-client5.9 Medium
- gm shanghai onstarA Man-in-the-Middle issue was discovered in General Motors (GM) and Shanghai OnStar (SOS) SOS iOS...5.9 Medium
- redhat gluster storage, red hat, inc. gluster storage for rhel 6 +1 moreIt was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017...7.4 High
- redhat gluster storage, red hat, inc. gluster storage for rhel 6 +1 moreIt was discovered that the fix for CVE-2017-12150 was not properly shipped in erratum RHSA-2017...5.9 Medium
- samba, debian linux, hp cifs server +5 more +7 moreA flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used...7.4 High
- samba, debian linux, redhat enterprise linux desktop +3 more +5 moreIt was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not...7.4 High
- siemens logo! 8 bm (incl. siplus variants), logo\! 8 bm firmware +1 moreA vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3)....7.4 High
- siemens sipass integratedA vulnerability was discovered in Siemens SiPass integrated (All versions before V2.70) that...7.4 High
- siemens simatic wincc sm@rtclient for android, simatic wincc sm\@rtclient +1 moreA vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android (All versions...7.4 High
- red hat, inc. rkhunter, rootkit hunter project hunter +1 morerkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing...9.8 Critical
- hyundai blue linkA Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4....3.7 Low
- apache http server, gnu gnutls, mozilla nss +5 more +7 moreApache Tomcat affected by vulnerability in TLS and SSL protocol5.8 Medium