Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving (1) replaying, (2) modifying, (3) inserting, or (4) deleting a single cell, and then observing cell recognition errors at the exit router. NOTE: the vendor disputes the significance of this issue, noting that the product's design "accepted end-to-end correlation as an attack that is too expensive to solve."
This public preview summarizes the normalized record without exposing paid citation paths. Use it to decide whether the device deserves a paid report, workspace review, or direct source verification.
Public pages show source names and record counts. Paid reports unlock source URLs, citation paths, and report-generation context.
For records that need deeper review, use the main access flow to request source-backed report context, saved workspace review, or support before relying on the public preview.
Security records are triage intelligence and should be validated against asset inventory, firmware versions, compensating controls, and vendor advisories.
Prioritize known exploited and high-confidence records.
Check support and vulnerability signals before purchase.
Use reports and monitors for customer device review.
Paid reports include citation paths and report-generation context; public previews intentionally hide source URLs.