Command injection

The Covet Fashion - Shopping Game aka com.crowdstar.covetfashion application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6774

The USEK aka com.university.usek application 1.0.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6754

The Vector Outage Manager aka nz.co.vector.outagemanager application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6636

The LG Telepresence aka com.rsupport.rtc.lge application 2.0.12 Build 63 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6012

The Gravity Bounce aka net.toddm.gb application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5974

The PSECU Mobile+ aka com.Vertifi.Mobile.P231381116 application 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

FreeBSD : nginx -- inject commands into SSL session vulnerability (77b784bb-3dc6-11e4-b191-f0def16c5c1b)

The nginx project reports : Security: it was possible to reuse SSL sessions in unrelated contexts if a shared SSL session cache or the same TLS session ticket key was used for multiple 'server' blocks CVE-2014-3616. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Important: Red Hat Security Advisory: axis security update

Updated axis packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2014-5894

The AireTalk: Text, Call, & More! aka com.pingshow.amper application 2.0.73 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Beauty Bible - App for Girls aka com.my.beauty.bible application 5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5887

The Yell Local Search aka com.yell.launcher2 application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5864

The Swish payments aka se.bankgirot.swish application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5687

The Runtastic Mountain Bike aka com.runtastic.android.mountainbike.lite application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5609

The Stickman Ski Racer aka com.djinnworks.StickmanSkiRacer.free application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5569

The Star Girl aka com.animoca.google.starGirl application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5534

The Princess Shopping aka air.android.PrincessShopping application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5613

The Able Remote aka com.entertailion.android.remote application 2.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5658

The MercadoLibre aka com.mercadolibre application 3.8.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

naxoshus.com XSS vulnerability

Vulnerable URL: http://naxoshus.com/0//wp-content/plugins/fgalleryplus/fimrss.php?album=%27%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%28String.fromCharCode%2888,%2083,%2083,%2080,%2079,%2083,%2069,%2068%29%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 21.11.2017...

OpenSSL TLS Heartbeat Extension - Memory Disclosure

No description provided by source. !/usr/bin/python Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford [email protected] The author disclaims copyright to this source code. import sys import struct import socket import time import select import re from optparse import...