CVE-2014-6670

CVE-2014-6670 affects the Android app “SingaporeMotherhood Forum” (com.tapatalk.singaporemotherhoodcomforum) version 3.6.6. The root cause is that the application does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a c...

CVE-2014-6652

The Wizaz Forum aka com.tapatalk.wizazplforum application 3.6.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6642

The Mark's Daily Apple Forum aka com.tapatalk.marksdailyapplecomforum application 2.4.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6643

The FIAT Forum aka com.tapatalk.fiatforumcom application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The FIAT Forum aka com.tapatalk.fiatforumcom application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6643

CVE-2014-6643 affects the FIAT Forum Android app (com.tapatalk.fiatforumcom) version 3.8.41, which does not verify X.509 certificates when establishing SSL connections. This enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via crafted certificates. ...

CVE-2014-6643

The FIAT Forum aka com.tapatalk.fiatforumcom application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6642

The Mark's Daily Apple Forum aka com.tapatalk.marksdailyapplecomforum application 2.4.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6642

The CVE concerns the Android app for The Mark’s Daily Apple Forum (com.tapatalk.marksdailyapplecomforum) v2.4.9.3, where the implementation does not verify X.509 certificates from SSL servers. This lack of certificate verification enables man-in-the-middle attackers to spoof servers and exfiltrat...

Paypal Inc BB #32 - Multiple Persistent Vulnerabilities

Document Title: =============== Paypal Inc BB 32 - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=716 Release Date: ============= 2014-09-22 Vulnerability Laboratory ID VL-ID: ==================================== 716...

IP Board 3.x - CSRF Token hjiacking

No description provided by source. Title: IP Board 3.x CSRF - Token hjiacking Date: 03.09.14 Version: = 3.4.6 Vendor: invisionpower.com Author: Piotr S. Video-PoC: https://www.youtube.com/watch?v=G5P21TA4DjY 1 Introduction Latest and propabbly previous IPB verions suffers on vulnerability, which...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

Design/Logic Flaw

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

CVE-2014-3617

The CVE-2014-3617 issue affects Moodle’s forum: the function forum_print_latest_discussions in mod/forum/lib.php allowed remote authenticated users to bypass the requirement to post an answer and to discover an author’s username by visiting a Q&A forum, without needing the mod/forum:viewqandawith...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

Updated moodle packages fix security vulnerbilities

Updated moodle packages fix security vulnerabilities: In Moodle before 2.6.5, users who had not yet posted the required answer in a Q forum in order to access past posts were able to see the name of the last person who had posted, as other authors are visible in /mod/forum/view.php before the...

5 Million Gmail Usernames and Passwords Leaked online, Check Yours Now

.jpg.jpg Gmail credentials leaked online? Oh my God! Again I have to change my password…!! Yes, you heard right. Millions of Gmail account credentials email address and password have been stolen and made publicly available through an online forum, causing a large number of users worldwide to chan...

Five Million Email Passwords, Addresses Leak Russian Forum

UPDATE–Nearly five million email addresses along with a list of passwords said to correspond with those email addresses showed up on a Russian-language Bitcoin security forum forum last night. Most of the email addresses belong to Gmail users. While the source of the email addresses and the...

vBulletin 5.1.x - Persistent Cross-Site Scripting

vBulletin 5.1.x - Persistent Cross-Site Scripting Title: vBulletin 5.1.X - Cross Site Scripting Date: 05.09.14 Version: = 5.1.2 Latest ATM Vendor: vbulletin.com Contact: smash at devilteam.pl 1 Agenda Latest vBulletin forum software suffers on persistent cross site scripting vulnerability, which...