CVE-2014-5351

The kadm5randkeyprincipal3 function in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access...

UBUNTU-CVE-2014-6417

net/ceph/authx.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service system crash or possibly have unspecified other impact via a long unencrypted auth ticket...

CVE-2014-5757

The Buy Tickets aka com.xcr.android.buytickets application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Buy Tickets aka com.xcr.android.buytickets application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5757

The CVE-2014-5757 entry affects the Android app Buy Tickets (com.xcr.android.buytickets) version 2.3. The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifi...

CVE-2014-5757

The Buy Tickets aka com.xcr.android.buytickets application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Amazon CloudFront Turns On Perfect Forward Secrecy

Add Amazon to the growing list of technology providers ensuring that its encryption capabilities exceed a minimum standard. Yesterday, the company announced that its web content delivery platform Amazon CloudFront had turned on Perfect Forward Secrecy, in addition to a number of changes designed ...

Zingiri Tickets - File Disclosure

The zingiri-tickets WordPress plugin was affected by a File Disclosure security vulnerability...

Tickets CAD 2.20G Multiple Vulnerabilities

No description provided by source. Exploit Title: Tickets CAD 2.20G Multiple Vulnerabilities Date: Aug 4 2012 Exploit Author: chap0 @chap0 Vendor Homepage: http://www.ticketscad.org Software Link: http://www.ticketscad.org/downloads/Tickets06222012V220G.zip Version: 2.20G Tested on: Ubuntu Ticket...

PHP Support Tickets 2.2 - Remote File Upload Vulnerability

No description provided by source. remote file upload script: PHPSupportTicketsv2.2 download from:http://www.phpsupporttickets.com/modules/phpsupporttickets.com/dist/free/PHPSupportTicketsv2.2.zip 1:www.site.com/path/index.php?page=register 2:New Ticket 3:upload php file shell...

am4ss <= 1.2 - Multiple Vulnerabilities

No description provided by source. Exploit Title : am4ss 1.2 = Multiple Vulnerabilities Author : s3n4t00r Home : Sec-w.com Version : all version Date : Jul 31, 2012 XSS Stored 1 1- Register 2 - Login here http://localhost/am4ss/orderdev.php?step=2 3- Create Ticket and add your code html or js 4-...

Hot Open Tickets <= 11012004 (CLASS_PATH) Remote Include Vuln

No description provided by source. DEVIL TEAM THE BEST POLISH TEAM HOT Hot Open Tickets hot11012004ver2f - Remote File Include Vulnerabilities Find by Kacper Rahim. Greetings For ALL DEVIL TEAM members, Special DragonHeart : Contact: [email protected] or http://www.devilteam.yum.pl Site scripts...

PHP Support Tickets 2.2 - Code Execution

No description provided by source. Exploit Title: PHP Support Tickets v2.2 Code Exec Google Dork: PHP Support Tickets v2.2 Date: 26.09.2010 Author: brainpillow Software Link: http://www.phpsupporttickets.com/ Version: 2.2 ==================================================================== Vuln...

Student Hacks Apple Passbook App to Get Free Flight Boarding Passes

Is Air Travel expensive for You?? Of course it’s costly for Common people. But, hackers have found a way out of it too. If you have an iPhone then there is no need to buy airline tickets, as a simple iPhone hack can fool any modern airport and get you a seat in first class for free. Anthony...

Sql injection

Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the 1 picklistname parameter in the getpicklists method to soap/customerportal.php, 2 where parameter in the getticketslist method to soap/customerportal.php, or 3...

CVE-2011-3199

Multiple cross-site scripting XSS vulnerabilities in Domain Technologie Control DTC before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 message body of a support ticket or unspecified vectors to the 2 DNS and 3 MX form, as demonstrated by the "Domain ro...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Domain Technologie Control DTC before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 message body of a support ticket or unspecified vectors to the 2 DNS and 3 MX form, as demonstrated by the "Domain ro...

GNUpanel 0.3.5_R4 Cross Site Request Forgery / Cross Site Scripting

Exploit Title :GNUpanel 0.3.5R4 - Multiple Vulnerabilities Vendor Homepage :http://wp.geeklab.com.ar/gl-en/gnupanel/ GNUPanel Version :0.3.5R4 Server :Centos 6.4 Exploit Author :Necmettin COSKUN =@babayarisi Blog :http://www.ncoskun.com http://www.grisapka.org Discovery date :03/11/2014 CVE :N/A...

[SECURITY] [DSA 2867-1] otrs2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2867-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso February 23, 2014 http://www.debian.org/security/faq -...

Debian Security Advisory DSA 2867-1 (otrs2 - several vulnerabilities)

Several vulnerabilities were discovered in otrs2, the Open Ticket Request System. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-1694 Norihiro Tanaka reported missing challenge token checks. An attacker that managed to take over the session of a logge...