139 matches found
Improper access control
UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty...
Perspective ICM Investigation And Case 5.1.1.16 Privilege Escalation
Exploit Title: Privilege Escalation - Perspective ICM Investigation & Case - 5.1.1.16 Date Reported to vendor: Jun 28, 2017 Date Accepted by vendor: Jun 11, 2017 Exploit Author: [email protected] Vendor Homepage: www.resolver.com Version: Perspective ICM Investigation & Case -...
Remote code execution
The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the application to man-in-the-middle attacks leading to possible remote code execution...
Interval International app for iOS authentication vulnerability
Interval International app for iOS is a travel management software from Interval USA. An authentication vulnerability exists in versions 3.3 through 3.5.1 of the Interval International app for iOS, which stems from the program failing to validate an X.509 certificate on the server side of an SSL...
State Bank of India State Bank Anywhere app for iOS Man-in-the-Middle Attack Vulnerability
State Bank of India State Bank Anywhere app for iOS is a mobile app for iOS from State Bank of India with features like quick access to manage bank accounts, manage balances, pay bills and send money. A security vulnerability exists in version 5.1.0 of the State Bank of India State Bank Anywhere...
Cross-Site Scripting (XSS)
Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...
Midea's i+ smart refrigerator has design logic flaws
The Midea i+ Smart Refrigerator is a smart home appliance developed by Midea Group. Midea's i+ Smart Refrigerator is susceptible to man-in-the-middle attacks due to the insecure protocol for transmitting data and the lack of validation of what is transmitted on the client and server side. The lac...
FoxyCart Bug Bounty #1 - Filter Bypass & Persistent Vulnerability
Document Title: =============== FoxyCart Bug Bounty 1 - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1451 098bdc9b309783df65044c5abb690dafdd4bcd436c380ae68c924fe37e14b4e0 Release Date: ============= 2015-07-15...
Code injection
Intel McAfee ePolicy Orchestrator ePO 4.x through 4.6.9 and 5.x through 5.1.2 does not validate server names and Certification Authority names in X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica...
BlinkSale Bug Bounty #1 - Encode & Validation Vulnerability
Document Title: =============== BlinkSale Bug Bounty 1 - Encode & Validation Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1416 Release Date: ============= 2015-02-06 Vulnerability Laboratory ID VL-ID: ====================================...
CVE-2014-5375
The server in Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0 does not properly validate the message owner matches the submitting user, which allows remote authenticated users to impersonate arbitrary users via the UserId and Owner tags...
Liferay Enterprise Portal 1.x/2.x/5.0.2 - Multiple XSS Vulnerabilities
No description provided by source. source: http://www.securityfocus.com/bid/10402/info It has been reported that Liferay Enterprise Portal is susceptible to multiple cross-site scripting and HTML injection vulnerabilities. User-supplied data from many input fields is included in server generated...
Amazon Linux AMI : mesa (ALAS-2013-198)
An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs Mozilla Firefox does this, an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application...
MGASA-2013-0190 Updated mesa packages fix multiple vulnerabilties
An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs Mozilla Firefox does this, an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application...
CentOS Update for glx-utils CESA-2013:0897 centos6
The remote host is missing an update for the SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Scientific Linux Security Update : mesa on SL6.x i386/x86_64 (20130603)
An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs Mozilla Firefox does this, an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application...
keystone: online validation of Keystone PKI tokens bypasses revocation check
OpenStack Keystone Folsom 2012.2 does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token...
Watson Management Console 4.11.2.G - Directory Traversal
Exploit Title: Watson Management Console Directory Traversal Vulnerability Google Dork: allintitle:Watson Management Console Contacted Vendor : 17/12/2012 as well as 31/12/2012 The Vendor Did Not Respond . Date: 1/2/2013 Exploit Author: Dhruv Shah Vendor Homepage: http://www.schmid-telecom.com/...
