158 matches found
Design/Logic Flaw
Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, related to the "FREAK" issue...
CVE-2015-1067
Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, related to the "FREAK" issue...
CVE-2015-1067
CVE-2015-1067 (Apple TLS FREAK issue) : Secure Transport on iOS (pre-8.2), OS X (≤10.10.2), and Apple TV (pre-7.1) could downgrade TLS to EXPORT_RSA ciphers via crafted traffic, enabling a cipher-downgrade attack related to the FREAK family. Affected products map to Apple SSL/TLS implementations;...
CVE-2015-1067
Secure Transport in Apple iOS before 8.2, Apple OS X through 10.10.2, and Apple TV before 7.1 does not properly restrict TLS state transitions, which makes it easier for remote attackers to conduct cipher-downgrade attacks to EXPORTRSA ciphers via crafted TLS traffic, related to the "FREAK" issue...
Mac OS X Multiple Vulnerabilities (Security Update 2015-002)
The remote host is running a version of Mac OS X 10.8, 10.9, or 10.10 that does not have Security Update 2015-002 applied. This update contains several security-related fixes for the following components : - iCloud Keychain - IOAcceleratorFamily - IOSurface - machportkobject kernel interface -...
CURL-CVE-2014-8151 Secure Transport certificate check bypass
libcurl stores TLS Session IDs in its associated Session ID cache when it connects to TLS servers. In subsequent connects it reuses the entry in the cache to resume the TLS connection faster than when doing a full TLS handshake. The actual implementation for the Session ID caching varies dependin...
Secure Transport certificate check bypass
libcurl stores TLS Session IDs in its associated Session ID cache when it connects to TLS servers. In subsequent connects it reuses the entry in the cache to resume the TLS connection faster than when doing a full TLS handshake. The actual implementation for the Session ID caching varies dependin...
Axway Secure Transport 5.1 SP2 - Arbitary File Upload via CSRF
No description provided by source. !-- Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF Exploit author: Emmanuel Law Public Disclosure Date : 20/10/14 Vendor homepage: http://www.axway.com Affected Software version: Axway Secure Transport 5.2.1 SP2 and possibly earlier...
APPLE-SA-2014-10-20-1 iOS 8.1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-20-1 iOS 8.1 iOS 8.1 is now available and addresses the following: Bluetooth Available for: iPhone 4s and later, iPod touch 5th generation and later, iPad 2 and later Impact: A malicious Bluetooth input device may bypass pairing...
Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery)
function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://sftp.example.org/api/v1.0/files/", true; xhr.setRequestHeader"Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8"; xhr.setRequestHeader...
Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery)
Axway Secure Transport 5.1 SP2 - Arbitrary File Upload via Cross-Site Request Forgery function submitRequest var xhr = new XMLHttpRequest; xhr.open"POST", "https://sftp.example.org/api/v1.0/files/", true; xhr.setRequestHeader"Accept", "text/ht...
Mac OS X < 10.10 Multiple Vulnerabilities (APPLE-SA-2014-10-16-1 OS X Yosemite v10.10)
Binary data 8555.prm...
APPLE-SA-2014-10-16-2 Security Update 2014-005
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-2 Security Update 2014-005 Security Update 2014-005 is now available and addresses the following: Secure Transport Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5 Impact: An attacker may be able to decrypt data...
Mac OS X < 10.10 Multiple Vulnerabilities (POODLE) (Shellshock)
The remote host is running a version of Mac OS X is prior to version 10.10. This update contains several security-related fixes for the following components : - 802.1X - AFP File Server - apache - App Sandbox - Bash - Bluetooth - Certificate Trust Policy - CFPreferences - CoreStorage - CUPS - Doc...
Apple Mac OS X Multiple Vulnerabilities -07 (Sep 2014)
Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2014-1361
Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection, which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DT...
Code injection
Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection, which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DT...
CVE-2014-1361
Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection, which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DT...
Mac OS X Multiple Vulnerabilities (Security Update 2014-003)
The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-003 applied. This update contains several security-related fixes for the following components : - copyfile - Dock - Graphics Driver - Intel Graphics Driver - Intel Compute - IOAcceleratorFamily -...