CVE-2012-3884

AirDroid 1.0.4 beta is affected by an authentication flaw where the login data (password hash) is transmitted over HTTP, enabling an attacker on the same wireless network to sniff traffic and replay credentials to gain access. Root cause: direct transmission of a password hash over HTTP without t...

CVE-2012-3887

AirDroid before 1.0.7 beta exposes a cleartext base64-encoded data channel that is documented as an Encrypted Transmission feature, allowing an attacker on the same LAN to sniff sensitive information (e.g., SMS content via sdctl/sms/send/single/). Root cause is misrepresentation of encryption rat...

Information disclosure

auth/ldap/ntlmssoattempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-3394

auth/ldap/ntlmssoattempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network...

CVE-2012-3394

auth/ldap/ntlmssoattempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http URL, which allows remote attackers to obtain sensitive information by sniffing the network...

PT-2012-4687 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.9 Moodle versions 2.1.x through 2.1.6 Moodle versions 2.2.x through 2.2.3 Moodle versions 2.3.x through 2.3.0 Description: The issue allows remote attackers to obtain sensitive information by sniffing the...

CVE-2012-2357

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

Authentication flaw

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2012-2357

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

UBUNTU-CVE-2012-2357

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2012-2357

CVE-2012-2357 affects Moodle 2.1.x (before 2.1.6) and 2.2.x (before 2.2.3). The issue is in the Multi-Authentication CAS feature (auth/cas/cas_form.html) that does not use HTTPS, enabling credential sniffing over the network by remote attackers. The root cause is unauthenticated, unencrypted tran...

CVE-2012-2357

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

PT-2012-3978 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.1.x through 2.1.5 Moodle versions 2.2.x through 2.2.2 Description: The issue concerns the Multi-Authentication feature in the Central Authentication Service CAS functionality. It does not utilize HTTPS, allowing remote...

CVE-2011-4585

login/changepassword.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network...

Design/Logic Flaw

login/changepassword.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2011-4585

login/changepassword.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2011-4585

CVE-2011-4585 affects Moodle 1.9.x before 1.9.15. The login/change_password.php form does not use HTTPS even when the httpslogin option is enabled, enabling credential sniffing over the network. Debian/OpenVAS references document this as part of a set of Moodle vulnerabilities; Debian’s advisory ...

CVE-2011-4585

login/changepassword.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network...

Traffic Sniffing, Not Botnet, May Have Led to Android Spam Run

It’s not every day that you get a security story that involves Yahoo, Google and Microsoft, but that’s what has happened with the claims from a Microsoft official that there was an Android-based botnet in existence sending spam from compromised devices. Now it seems that the spam emanating from...

Design/Logic Flaw

The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering multiple requests to a...