2462 matches found
Design/Logic Flaw
The FREE Pageplus Activation aka com.wFREEPageplusActivations application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5745
The CVE-2014-5745 entry concerns the FREE Pageplus Activation Android app (com.wFREEPageplusActivations) version 0.1, which does not verify X.509 certificates from SSL servers. This lax TLS validation can enable man-in-the-middle attackers to spoof servers and obtain sensitive information via a c...
SuSE 11.3 Security Update : glibc (SAT Patch Number 9587)
This glibc update contains one security and two non security fixes : - directory traversal in LC locale handling. CVE-2014-0475. bnc887022 - nscd gets activated upon upgrade. bnc882028 - iconv command inserts a extra control code '0F'. bnc886416 %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
Android new attack: Google Voice Search attack-vulnerability warning-the black bar safety net
Chinese University of Hong Kong researchers in the Preprint posted on the website of paper PDF, describes a novel permission to bypass attack method: Google Voice Search attack. An attacker can leverage a zero-permissions Android app VoicEmployer, front activationoperating system built-in voice...
OpenJDK: Activation framework default command map caching (JAX-WS, 8025152)
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423...
July 2014 Apple security patches
Apple has issued a slew of security updates addressing a wide swath of vulnerabilities in its Safari Web browser, Mavericks desktop operating system, iOS mobile platform and content streaming AppleTV product. Apple doesn’t rate the severity of the vulnerabilities it fixes nor does it advise on...
CVE-2014-1360
Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors...
Authentication flaw
Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors...
CVE-2014-1360
Lockdown in Apple iOS before 7.1.2 does not properly verify data from activation servers, which makes it easier for physically proximate attackers to bypass the Activation Lock protection mechanism via unspecified vectors...
CVE-2014-1360
CVE-2014-1360 affects Apple iOS prior to 7.1.2. The issue is a failure to properly verify data from activation servers, enabling a physically proximate attacker to bypass Activation Lock via unspecified vectors. The CVE notes a local attack vector with low base severity (I: Partial, A: None). App...
Comptel Provisioning and Activation 'error_msg_parameter' Cross Site Scripting Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/38534/info Comptel Provisioning and Activation is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...
Huawei Technologies du Mobile Broadband 16.0 - Local Privilege Escalation
No description provided by source. Huawei Technologies du Mobile Broadband 16.0 Local Privilege Escalation Vendor: Huawei Technologies Co., Ltd. Product Web Page: http://www.huawei.com Affected version: 16.002.03.16.124 Summary: du Mobile Broadband is a shareware application for du EITC UAE users...
PHP <= 5.1.6 Mb_Parse_Str Function Register_Globals Activation Weakness
No description provided by source. source: http://www.securityfocus.com/bid/23016/info PHP is prone to a weakness that allows attackers to enable the 'registerglobals' directive because the application fails to handle a memory-limit exception. Enabling the PHP 'registerglobals' directive may allo...
eZ Publish < 3.9.5/3.10.1/4.0.1 (token) Privilege Escalation Exploit
No description provided by source. ?php / eZ Publish privilege escalation and weak activation token for new user exploit by s4avrd0w [email protected] Versions affected = 3.5.6 eZ Publish privilege escalation resolved in 3.9.5, 3.10.1, 4.0.1 More info:...
Native Instruments Service Center 2.2.5 - Local Privilege Escalation Vulnerability
No description provided by source. Native Instruments Service Center 2.2.5 Local Privilege Escalation Vulnerability Vendor: Native Instruments GmbH Product web page: http://www.native-instruments.com Affected version: 2.2.5 R596 Summary: The NI Service Center is a service used for Product...
WordPress Facebook Promotions plugin <= 1.3.3 - SQL Injection Vulnerability
No description provided by source. Exploit Title: WordPress Facebook Promotions plugin = 1.3.3 SQL Injection Vulnerability Date: 2011-08-28 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/fbpromotions.1.3.3.zip Version: 1.3.3...
OpenJDK: Activation framework default command map caching (JAX-WS, 8025152)
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423...
OpenJDK: Activation framework default command map caching (JAX-WS, 8025152)
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423...
OpenJDK: Activation framework default command map caching (JAX-WS, 8025152)
Unspecified vulnerability in Oracle Java SE 6u71, 7u51, and 8, and Java SE Embedded 7u51, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAX-WS, a different vulnerability than CVE-2014-0452 and CVE-2014-2423...
Apple iCloud and Activation Lock Hacked; Allows Hackers to Unlock Stolen Devices
A Dutch-Moroccan team of hackers calling itself "Team DoulCi" have reportedly claimed to hack a protective feature on Apple’s iCloud system, that could leverage an attacker to remove security measures on lost or stolen iPhone devices. According to a report from Dutch news organization De Telegraa...