PT-2012-6128

Name of the Vulnerable Software and Affected Versions AOL Instant Messenger AIM version 1.0.1.2 Description The issue arises from the failure to verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate. This allows...

CVE-2012-5796: Improper Input Validation

The PayPal Pro module in osCommerce does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

phpMyAdmin 3.5.x < 3.5.3 Multiple Vulnerabilities (PMASA-2012-6 - PMASA-2012-7)

According to its self-identified version number, the phpMyAdmin 3.5.x install hosted on the remote web server is earlier than 3.5.3 and is, therefore, affected by multiple vulnerabilities : - When creating or modifying a trigger, event, or procedure with a crafted name, it is possible for a user ...

CVE-2012-4511

services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2011-4129

1 services/twitter/twitter-contact-view.c and 2 services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

Code injection

services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

CVE-2011-4129

CVE-2011-4129 affects libsocialweb b4 0.25.20, specifically the Twitter integration in twitter-contact-view.c and twitter-item-view.c. The code automatically connects to Twitter when no Twitter account is configured, which could enable a remote attacker to obtain sensitive information via a man-i...

CVE-2012-4511

CVE-2012-4511 affects libsocialweb prior to 0.25.21, where the library creates an untrusted connection to Flickr when no Flickr account is configured. This behavior can enable a man‑in‑the‑middle (MITM) attacker to access sensitive information or alter data, as described in multiple advisories. F...

CVE-2012-4511

Removed by vendor...

CVE-2011-4129

Removed by vendor...

PT-2012-1807

Name of the Vulnerable Software and Affected Versions libsocialweb versions prior to 0.25.20 Description The issue allows remote attackers to potentially obtain sensitive information via a man-in-the-middle MITM attack. This occurs because certain components in libsocialweb automatically connect ...

PT-2012-5451

Name of the Vulnerable Software and Affected Versions libsocialweb versions prior to 0.25.21 Description The issue allows remote attackers to potentially obtain sensitive information via a man-in-the-middle MITM attack. This occurs because the services/flickr/flickr.c component in libsocialweb...

CVE-2012-4511: Exposure of Sensitive Information to an Unauthorized Actor

services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

MitM-vulnerability in Palo Alto Networks GlobalProtect

--------------------------------------------------------------------- SySS-Advisory: MitM-vulnerability in Palo Alto Networks GlobalProtect --------------------------------------------------------------------- Problem discovered: July 12th 2012 Vendor contacted: July 13th 2012 Advisory published:...

CVE-2011-4129: Exposure of Sensitive Information to an Unauthorized Actor

1 services/twitter/twitter-contact-view.c and 2 services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle MITM attack...

Research Shows Serious Problems With Android App SSL Implementations

There are thousands of apps in the Google Play mobile market that contain serious mistakes in the way that SSL/TLS is implemented, leaving them vulnerable to man-in-the-middle attacks that could compromise sensitive user data such as banking credentials, credit card numbers and other information...

FreeBSD : phpMyAdmin -- Multiple XSS due to unescaped HTML output in Trigger, Procedure and Event pages and Fetching the version information from a non-SSL site is vulnerable to a MITM attack (ef417da3-1640-11e2-999b-e0cb4e266481)

The phpMyAdmin development team reports : When creating/modifying a trigger, event or procedure with a crafted name, it is possible to trigger an XSS. To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the phpmyadmin.net website in...

Fetching the version information from a non-SSL site is vulnerable to a MITM attack.

PMASA-2012-7 Announcement-ID: PMASA-2012-7 Date: 2012-10-12 Summary Fetching the version information from a non-SSL site is vulnerable to a MITM attack. Description To display information about the current phpMyAdmin version on the main page, a piece of JavaScript is fetched from the phpmyadmin.n...

CVE-2012-5356

The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary...

CVE-2012-5356

The apt-add-repository tool in Ubuntu Software Properties 0.75.x before 0.75.10.3, 0.80.x before 0.80.9.2, 0.81.x before 0.81.13.5, 0.82.x before 0.82.7.3, and 0.92.x before 0.92.8 does not properly check PPA GPG keys imported from a keyserver, which allows remote attackers to install arbitrary...