CVE-2015-5997

Impero Education Pro before 5105 uses a hardcoded CBC key and initialization vector derived from a hash of the Imp3ro string, which makes it easier for remote attackers to obtain plaintext data by sniffing the network for ciphertext data...

Hardcoded credentials

Impero Education Pro before 5105 uses a hardcoded CBC key and initialization vector derived from a hash of the Imp3ro string, which makes it easier for remote attackers to obtain plaintext data by sniffing the network for ciphertext data...

CVE-2015-5997

Impero Education Pro before 5105 uses a hardcoded CBC key and initialization vector derived from a hash of the Imp3ro string, which makes it easier for remote attackers to obtain plaintext data by sniffing the network for ciphertext data...

CVE-2015-5997

Impero Education Pro prior to 5105 is affected by CVE-2015-5997 due to a hard-coded CBC key and an IV derived from the hash of the string Imp3ro. This weak cryptographic setup enables an attacker who can sniff encrypted network traffic to recover plaintext data. The vulnerability affects the encr...

Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability

Avira Mobile Security iOS Application - Cleartext Credentials Vulnerability -- http://www.info-sec.ca/advisories/Avira-Mobile-Security.html Overview "Avira Mobile Security is the ideal tool to recover a lost phone and ensure that your email has not been compromised." "Avira Mobile Security helps...

CVE-2015-0943

Basware Banking Maksuliikenne before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting...

CVE-2015-0943

Basware Banking Maksuliikenne before 9.10.0.0 does not encrypt communication between the client and the backend server, which allows man-in-the-middle attackers to obtain encryption keys, user credentials, and other sensitive information by sniffing the network or modify this traffic by inserting...

ownCloud: owncloud.com: Content Sniffing not disabled

URL :- https://owncloud.com Issue description :- There was no "X-Content-Type-Options" HTTP header with the value nosniff set in the response. The lack of this header causes that certain browsers, try to determine the content type and encoding of the response even when these properties are define...

Apple iOS Safari WebKit Security Bypass Vulnerability

Apple iOS is the latest operating system that runs on Apple's iPhone and iPod touch devices. A security vulnerability exists in WebKit in Apple Safari used in Apple iOS, which can be exploited by attackers to perform man-in-the-middle attacks and obtain sensitive information through sniffing the...

CVE-2015-3778

bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by sniffing an 802.11 network for DNAv4 broadcast traffic...

CVE-2015-3774

The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word definitions by modifying the client-server data stream...

CVE-2015-3750

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security HSTS protection mechanism for Content Security Policy CSP report requests, which allows man-in-the-middle attackers to...

Design/Logic Flaw

bootp in Apple iOS before 8.4.1 and OS X before 10.10.5 allows remote attackers to obtain potentially sensitive information about MAC addresses seen in previous Wi-Fi sessions by sniffing an 802.11 network for DNAv4 broadcast traffic...

UBUNTU-CVE-2015-3750

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security HSTS protection mechanism for Content Security Policy CSP report requests, which allows man-in-the-middle attackers to...

Design/Logic Flaw

The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word definitions by modifying the client-server data stream...

CVE-2015-3774

The Dictionary app in Apple OS X before 10.10.5 does not use HTTPS, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof word definitions by modifying the client-server data stream...

CVE-2015-3778

CVE-2015-3778 affects Apple iOS prior to 8.4.1 and OS X prior to 10.10.5. The issue allows a remote attacker on a DNAv4-enabled 802.11 network to sniff broadcast traffic and potentially learn MAC addresses seen in previous Wi‑Fi sessions, i.e., an information-disclosure vulnerability. The root ca...

CVE-2015-2471

Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than...

Information disclosure

Microsoft XML Core Services 3.0 and 5.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than...

Information disclosure

Microsoft XML Core Services 3.0, 5.0, and 6.0 supports SSL 2.0, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by sniffing the network and conducting a decryption attack, aka "MSXML Information Disclosure Vulnerability," a different vulnerability than...