CWE-300 Channel Accessible by Non-Endpoint
Description
The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-300 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-f7w7-6pjc-wwm6 | CVE-2009-3555 | CRITICAL |
Apache Tomcat affected by vulnerability in TLS and SSL protocol |
2026-06-08 | |
| GHSA-cgvx-9447-vcch | CVE-2024-39705 | HIGH |
ntlk unsafe deserialization vulnerability |
2025-01-21 | |
| GHSA-6cf6-8hvr-r68w | CVE-2024-31206 | HIGH |
dectalk-tts Uses Unencrypted HTTP Request |
2024-04-05 | |
| GHSA-q8qq-2p5p-rg44 | CVE-2020-2185 | MODERATE |
Missing SSH host key validation in Jenkins Amazon EC2 Plugin |
2023-12-14 | |
| GHSA-j3rq-4xjw-xg63 | - | HIGH |
Go package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacks |
2023-12-04 | |
| GHSA-pc5p-h8pf-mvwp | - | MODERATE |
Machine-In-The-Middle in https-proxy-agent |
2023-11-01 | |
| GHSA-4r4m-hjwj-43p8 | CVE-2016-10536 | MODERATE |
Insecure Defaults Allow MITM Over TLS in engine.io-client |
2023-09-07 | |
| GHSA-fx6x-h9g4-56f8 | CVE-2020-10749 | MODERATE |
containernetworking/plugins vulnerable to MitM attacks |
2023-08-22 | |
| GHSA-345p-pw5q-g98v | CVE-2019-16546 | MODERATE |
Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin |
2022-12-06 | |
| GHSA-p788-rj37-357w | CVE-2016-1000224 | MODERATE |
Insecure Defaults Leads to Potential MITM in ezseed-transmission |
2021-09-23 |