Monthly
Cleartext-transmission exposure in Hitachi Energy PROMOD V allows a network man-in-the-middle to intercept or read sensitive data because the application relies on unencrypted HTTP rather than HTTPS when communicating with a third-party Digipede grid-computing server. The flaw (CWE-1428, reliance on an insecure communications channel) carries a CVSS 4.0 base score of 7.0 and is rated high confidentiality impact with limited integrity impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Man-in-the-middle attacks against AMD's optional desktop tools - AMD Management Console (AMC), AMD Ryzen Master, and AMD μProf - can lead to arbitrary code execution because the affected utilities transport data over plaintext HTTP rather than TLS. An attacker positioned on the network path between a victim workstation and the AMD endpoint can tamper with traffic (most plausibly update or telemetry channels) to substitute malicious content that is then executed by the tool. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS data was not provided.
Cleartext transmission of credentials, authentication tokens, and device commands in the mH-DEVELOPER smart home module (F&F Filipowski) exposes every web interface and API session to interception by anyone sharing the same local network segment. Every version prior to 3.0.30 is affected, and because no TLS is used, a passive sniffer or an attacker who establishes an interception position (for example via ARP spoofing or a rogue access point) can harvest passwords and session tokens and then hijack sessions to issue device commands. Exploitation requires only an adjacent-network position and no authentication on the module itself; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, but the confidentiality impact is high and the flaw is trivially exploitable wherever untrusted clients, guest Wi-Fi, or shared VLANs can reach the device. Vendor-released patch: version 3.0.30.
Cleartext-transmission exposure in Hitachi Energy PROMOD V allows a network man-in-the-middle to intercept or read sensitive data because the application relies on unencrypted HTTP rather than HTTPS when communicating with a third-party Digipede grid-computing server. The flaw (CWE-1428, reliance on an insecure communications channel) carries a CVSS 4.0 base score of 7.0 and is rated high confidentiality impact with limited integrity impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Man-in-the-middle attacks against AMD's optional desktop tools - AMD Management Console (AMC), AMD Ryzen Master, and AMD μProf - can lead to arbitrary code execution because the affected utilities transport data over plaintext HTTP rather than TLS. An attacker positioned on the network path between a victim workstation and the AMD endpoint can tamper with traffic (most plausibly update or telemetry channels) to substitute malicious content that is then executed by the tool. No public exploit identified at time of analysis and the issue is not in CISA KEV; EPSS data was not provided.
Cleartext transmission of credentials, authentication tokens, and device commands in the mH-DEVELOPER smart home module (F&F Filipowski) exposes every web interface and API session to interception by anyone sharing the same local network segment. Every version prior to 3.0.30 is affected, and because no TLS is used, a passive sniffer or an attacker who establishes an interception position (for example via ARP spoofing or a rogue access point) can harvest passwords and session tokens and then hijack sessions to issue device commands. Exploitation requires only an adjacent-network position and no authentication on the module itself; there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis, but the confidentiality impact is high and the flaw is trivially exploitable wherever untrusted clients, guest Wi-Fi, or shared VLANs can reach the device. Vendor-released patch: version 3.0.30.