CVE-2014-7471

The international-arbitration-attorney.com aka com.w0f1d79a1010d819acbee876007d0bebc application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Letters to God - soc. network aka com.wPismakBoguLetterstoGod application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The 100 Beauty Tips aka com.ww100BeautyTipsApp application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The nashaplaneta.su aka com.wNashaPlaneta application 1.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4437

CVE-2014-4437 affects Apple OS X LaunchServices (pre-10.10). The flaw allows a sandboxed application to bypass restrictions by registering a crafted Content-Type handler for an object. Root cause: the LaunchServices interface allowed sandboxed apps to set content-type handlers, enabling sandbox b...

Information disclosure

The Arabic Troll Football aka com.hamoosh.ArabicTrollFootball application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6996

The CVE-2014-6996 entry concerns the Android app “Martial Arts Battle Card” (com.tapenjoy.zjh.tw) version 1.0.9, where SSL/TLS connections do not verify X.509 certificates. The underlying issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted cert...

CVE-2014-6953

The AFTERLIFE WITH ARCHIE aka com.afterlifewitharchie.afterlifewitharchie application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Croogo 2.0.0 Cross Site Scripting

------------------------ XSS 1 -------- POST parameters: - dataContacttitle ------------------------ input type="hidden" name="dataTokenkey" value="2627e9e2...

F5 Networks BIG-IP : GnuTLS vulnerability (SOL15637)

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service buffer over-read and crash via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. C Tenable Network Security, Inc. The...

Square: CSRF on adding clients

Authenticate to an account. 2. Trick the victim to submit the following HTML: input type="hidden"...

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

It was found that the SecurityTokenService STS, provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens...

CVE-2014-6805

The CVE-2014-6805 entry concerns the Android Weibo (magic.weibo) app version 1.2, which does not verify X.509 certificates when establishing SSL connections. This behavior allows man-in-the-middle attackers to spoof HTTPS servers and obtain sensitive information via a crafted certificate. Per ava...

Code injection

The United Educational CU aka com.metova.cuae.uecu application 1.0.27 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

OSClass 3.4.1 - 'index.php' Local File Inclusion

Information ----------- Advisory by Netsparker. Name : LFI Vulnerability in OsClass Affected Software : OsClass Affected Versions: 3.4.1 and possibly below Vendor Homepage : http://osclass.org/ Vulnerability Type : Local File Inclusion Severity : Critical CVE-ID: CVE-2014-6308 Netsparker Advisory...

Code injection

The Apploi Job Search- Find Jobs aka com.apploi application 4.19 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

phpMyAdmin 4.0.x < 4.0.10.3 / 4.1.x < 4.1.14.4 / 4.2.x < 4.2.8.1 Micro History XSS and XSRF Vulnerabilities (PMASA-2014-10)

According to its self-reported version number, the phpMyAdmin application hosted on the remote web server is 4.0.x prior to 4.0.10.3, 4.1.x prior to 4.1.14.4, or 4.2.x prior to 4.2.8.1. It is, therefore, affected by an input-validation error related to the 'micro history' feature that could allow...

ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability

Document Title: =============== ChatSecure IM v2.2.4 iOS - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1317 Release Date: ============= 2014-09-10 Vulnerability Laboratory ID VL-ID: ==================================== 13...

CVE-2014-5853

The CVE-2014-5853 entry concerns the Android application Knights N Squires (com.com2us.imhero.normal.freefull.google.global.android.common) version 1.1.2 that does not verify X.509 certificates from SSL servers. This insecure TLS handling enables a man‑in‑the‑middle attacker to spoof servers and ...

Design/Logic Flaw

The SAS: Zombie Assault 3 aka com.ninjakiwi.sas3zombieassault application 2.56 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...