Skip to content
Threat Feed
Subscribe

Tag

Insecure-Configuration

3 briefs RSS
high advisory

goshs SSH Tunnel Vulnerable to MITM via Insecure Host Key Handling

The goshs application disables SSH host key verification when using the --tunnel flag, making it vulnerable to man-in-the-middle attacks that expose plaintext HTTP traffic.

goshs/v2 <= 2.0.6 mitm ssh insecure-configuration
2r 6t
high advisory

HKUDS OpenHarness Insecure Default Configuration Vulnerability

HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit permissive access, potentially leading to unauthorized file disclosure and read access.

vulnerability insecure-configuration access-control
2r 1t 1c
high advisory

libssh Insecure Configuration Allows Local MITM Attacks (CVE-2025-14821)

CVE-2025-14821 in libssh allows local man-in-the-middle attacks, SSH downgrade attacks, and trusted host manipulation due to insecure default configuration loading from a world-writable directory on Windows.

libssh mitm windows cve-2025-14821 insecure-configuration
2r 2t 1c