CVE-2015-8688: Improper Input Validation

Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza...

PT-2016-3953

Name of the Vulnerable Software and Affected Versions Gajim versions prior to 0.16.5 Description The issue allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza. Recommendations For versions prior to 0.16.5, update to version 0.16.5 or later to...

gajim: man-in-the-middle

It was found that gajim doesn't verify the origin of roster pushes thus allowing third parties to modify the roster. This vulnerability allows to intercept messages resulting in man-in-the-middle...

Design/Logic Flaw

The SIM Toolkit STK framework in Android before 5.1.1 LMY48I allows attackers to 1 intercept or 2 emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171...

CVE-2015-3843: Undefined Security Weakness

The SIM Toolkit STK framework in Android before 5.1.1 LMY48I allows attackers to 1 intercept or 2 emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171...

PT-2015-2212

Name of the Vulnerable Software and Affected Versions Android versions prior to 5.1.1 LMY48I Description The issue is related to insufficient access control in the SIM Toolkit component of the Android operating system. This can be exploited by a remote attacker using a specially crafted applicati...

CVE-2015-3843

The SIM Toolkit STK framework in Android before 5.1.1 LMY48I allows attackers to 1 intercept or 2 emulate unspecified Telephony STK SIM commands via an application that sends a crafted Intent, related to com/android/internal/telephony/cat/AppInterface.java, aka internal bug 21697171...

Apple iOS App App Communication Interception Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. Apple iOS suffers from a security vulnerability that allows malicious applications to intercept URL mechanism communication between Apps...

Love fast router web Management page several vulnerabilities SQL blind injection, the plaintext stored passwords-bug warning-the black bar safety net

SQL blind injection, you can bypass the web page login authentication login default user name is admin. Password admin） I tested the ip is 1 9 2. 1 6 8. 1 6 8. 1:8 0,blind the url is http://192.168.168.1/login/x The user name of the payload is -1" OR 321=6 AND 0 0 0 1 6 7=0 0 0 1 6 7 -- The...

Hacking Team and Boeing Built Cyber Weaponized Drones to Spy on Targets

The leaked internal emails from the Italian surveillance software company Hacking Team have revealed that the spyware company developed a robotic aircraft designed to attack computers and smartphone devices through Wi-Fi networks. Over a year ago, some security researchers developed a drone calle...

Femtocell home base station to a communication to intercept, fake arbitrary SMS vulnerability-vulnerability warning-the black bar safety net

Ali mobile security team with the Chinese Thiel Laboratory of wireless technology Ministry of communication experts together, the combination of domestic operator a type of Femtocell base station for the security analysis, found that the more pieces of the major vulnerabilities that can lead to...

VK.com: Able to intercept app Traffic after choosing up the Secured Connection using SSL (HTTPS)

Install the app Login with Valid credentials Settings - Choose Secured connection HTTPS Close the app Set the proxy and Open the app verify that Connection isn't Secured and able to intercept PFA POC Expected Result : Secured layer & SSL PINING should be applied successfully...

Cisco NX-OS OpenSSL Multiple Vulnerabilities (cisco-sa-20150310-ssl) (FREAK)

The remote Cisco device is running a version of NX-OS software that is affected by multiple vulnerabilities in its bundled OpenSSL library: - A NULL pointer dereference flaw exists when the SSLv3 option isn't enabled and an SSLv3 ClientHello is received. This allows a remote attacker, using an...

CVE-2015-1848

The pcs daemon pcsd in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerabili...

Cisco UCS Central Software Security Vulnerabilities Patched

Cisco has patched a serious remote code execution vulnerability in its Unified Computing System UCS Central software, a data center platform that integrates processing, networking, storage and virtualization into one system. “An attacker could exploit this vulnerability by sending a crafted HTTP...

Unspecified Vulnerability in Barracuda Networks Web Filter

Barracuda Networks Web Filter is a Web security gateway from Barracuda Networks USA. The gateway supports content filtering, advanced policies, and web threat protection. A security vulnerability exists in versions prior to Barracuda Networks Web Filter 8.1.0.005, which stems from multiple device...

Grindr v2.1.1 iOS - (eMail) Session Vulnerability

Document Title: =============== Grindr v2.1.1 iOS - eMail Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1426 Release Date: ============= 2015-05-04 Vulnerability Laboratory ID VL-ID: ==================================== 1426 Commo...

Adobe Flash Player latest Vulnerability, CVE-2 0 1 5-3 0 4 4: The camera and microphone can be remote control-vulnerability warning-the black bar safety net

Researchers recently found that Adobe Flash Player some version vulnerability exists, an attacker could exploit the vulnerability can be by means of PC built-in camera and microphone for the user to be monitored. Vulnerability description The Flash Player configuration panel there is a list of...

Caught on the web of any user of the password reset vulnerability-vulnerability warning-the black bar safety net

Phone reset password password reset operation is not associated with a specific phone number, the lead can be reset to any phone registration account password. 1. The following url returns a result, you can traverse all the mobile phones registered account: http://api1.fun.tv/ajax/getmobilevcode/...

X (Formerly Twitter): Fabric.io: Ex-admin of an organization can delete team members

When an admin is deleted from an organization, his access rights are not removed properly. This allows an ex-admin to delete team members from the organization. Before proceeding with attack, 1. Create an organization with two accounts. Lets say, VictimOrg - Victimadmin, Victimmember 2. Invite...