Code injection

The All Navalny aka com.all.navalny application 1.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6932

CVE-2014-6932 affects the Android All Navalny app (1.10). The vulnerability is due to the app not verifying X.509 certificates in SSL/TLS, allowing MITM attackers to spoof servers and exfiltrate sensitive information via crafted certificates. Root cause: missing server cert verification during SS...

CVE-2014-6932: Undefined Security Weakness

The All Navalny aka com.all.navalny application 1.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7608

Name of the Vulnerable Software and Affected Versions All Navalny aka com.all.navalny application version 1.10 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

Sql injection

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6242

All In One WP Security & Firewall (WordPress) has SQL injection vulnerabilities fixed in version 3.8.3 and earlier analyzed in CVE-2014-6242. HTB reports two SQLi flaws affecting all versions before 3.8.3, exploitable via the orderby and order parameters to wp-admin/admin.php (aiowpsec page). Exp...

PT-2014-7115

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall plugin versions prior to 3.8.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the orderby or order parameter in the aiowpsec page to wp-admin/admin.php. This can ...

CVE-2014-6242: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6742

The CVE-2014-6742 entry concerns the Android app “All around Cyprus” (com.cyprus.newspapers), version 2.11, which fails to verify X.509 certificates when connecting to SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and access sensitive information via crafted ce...

PT-2014-7420

Name of the Vulnerable Software and Affected Versions The All around Cyprus aka com.cyprus.newspapers application version 2.11 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information...

CVE-2014-6742: Undefined Security Weakness

The All around Cyprus aka com.cyprus.newspapers application 2.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

WordPress All In One WP Security Plugin 3.8.2 SQL Injection Vulnerability

WordPress All In One WP Security plugin version 3.8.2 suffers from multiple remote SQL injection vulnerabilities. Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication...

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without...

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection

Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without technical details Vendor Notification: September 3, 2014 Vendor...

6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...

6: JSM policy not respected by deployed applications

It was found that Java Security Manager permissions configured via a policy file were not properly applied, causing all deployed applications to be granted the java.security.AllPermission permission. In certain cases, an attacker could use this flaw to circumvent expected security measures to...

CVE-2014-5938

CVE-2014-5938 affects the AllDealsAsia All Deals ADA Android app (package com.ada.deals) version 4.2.1. The app does not verify X.509 certificates when connecting to SSL servers, enabling potential MITM attackers to spoof servers and access sensitive data via a crafted certificate. No remediation...

CVE-2014-5938: Undefined Security Weakness

The AllDealsAsia All Deals ADA app aka com.ada.deals application 4.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...