1501 matches found
CVE-2014-8609
The CVE-2014-8609 vulnerability affects the Android Settings application (pre-5.0.0) where AddAccountSettings.java creates a PendingIntent incorrectly. This allows a third-party authenticator to trigger a broadcast using the SYSTEM UID, potentially injecting arbitrary component, action, or catego...
Android Settings Pendingintent Leak Vulnerability
In Android versions prior to 5.0 and possibly greater than and equal to 4.0, Settings application leaks Pendingintent with a blank base intent neither the component nor the action is explicitly set to third party applications. Due to this, a malicious app can use this to broadcast intent with the...
OracleVM 3.3 : rsyslog (OVMSA-2014-0030)
The remote OracleVM system is missing necessary patches to address critical security updates : - use setsid to get a controlling session and process group Orabug: 17346261 Todd Vierling - fix CVE-2014-3634 resolves: 1149148 - drop patch 5 which introduced a regression resolves: 927405 reverts:...
WSS最新版任意用户密码重置（官方demo演示）
简要描述： WSS最新版设计缺陷导致任意用户密码重置，包括管理员，官方demo演示 详细说明： WSS最新版设计缺陷导致任意用户密码重置，包括管理员 文件usereditpassword.php 保存成功 如果UID不正确会返回错误，没权限，但是不影响密码重置 这里测试用户的UID=7 重置之后，admin用户登录： img src="https://images.seebug.org/upload/201411/21230710e7a8dd96f6edc8d36d5b9f2c0b2ad747...
Information disclosure
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID...
CVE-2014-4448
The CVE-2014-4448 entry concerns Apple iOS House Arrest prior to iOS 8.1, where the Documents directory could be exposed because files were encrypted with a key protected only by the hardware UID. This is caused by relying on the hardware UID as the encryption key, enabling physically proximate a...
CVE-2014-4448
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID...
PayPal Inc BB #96 - Persistent Tags Vulnerability
Document Title: =============== PayPal Inc BB 96 - Persistent Tags Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=954 PayPal Security UID: apf87gW Release Date: ============= 2014-10-08 Vulnerability Laboratory ID VL-ID:...
PayPal Inc BB #70 FR - Persistent Mail Vulnerability
Document Title: =============== PayPal Inc BB 70 FR - Persistent Mail Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=869 PayPal Security UID: Roc83bl Release Date: ============= 2014-09-25 Vulnerability Laboratory ID VL-ID:...
PayPal Inc BB #59 - Persistent Mail Encoding Vulnerability
Document Title: =============== PayPal Inc BB 59 - Persistent Mail Encoding Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=844 PayPal Security UID: CabdfGa Release Date: ============= 2014-09-23 Vulnerability Laboratory ID VL-ID:...
Information disclosure
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID...
CVE-2014-4352
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID...
CVE-2014-4352
The CVE-2014-4352 entry corresponds to Address Book in iOS prior to 8, where the encryption key was derived from the hardware UID. This design allowed a physically proximate attacker to read the address book. The issue was addressed in iOS 8 by encrypting the address book with a key protected by ...
Sql injection
Multiple SQL injection vulnerabilities in Campaign11.exe in Arial Software Campaign Enterprise before 11.0.551 allow remote attackers to execute arbitrary SQL commands via the 1 SerialNumber field to activate.asp or 2 UID field to User-Edit.asp...
WP App Maker 1.0.16.4 - icons-launcher.php uid Parameter Reflected XSS
The wp-app-maker WordPress plugin was affected by an icons-launcher.php uid Parameter Reflected XSS security vulnerability...
Phpyun设计缺陷致任意文件删除可致重装getshell或注入
简要描述： 设计缺陷可致任意文件删除 删除lock可直接进行重装直接达到getshell。 或者删除某文件也可以来注入了。 也可导致破坏sql语句。 P.S.又是1点多了,明天又无法认真上课了。 2014年7月23日 01:30:01 新的一天快乐。 详细说明： 依旧官网下的最新版。 在model/ajax.class.php中 function deluploadaction if!$this-uid && !$this-username && $COOKIE"usertype"!=2 echo 0;die; else $dir=$POSTstr0; $isuser =...
NETGEAR WNR1000v3 - Password Recovery Credential Disclosure (Metasploit)
NETGEAR WNR1000v3 - Password Recovery Credential Disclosure Metasploit This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework Exploit Title: Netgear WNR1000v3 Password Recovery Credential Disclosure Vulnerability Date: 7-5-14...
CVE-2014-4578
Cross-site scripting XSS vulnerability in asset-studio/icons-launcher.php in the WP App Maker plugin 1.0.16.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in asset-studio/icons-launcher.php in the WP App Maker plugin 1.0.16.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the uid parameter...
Qpopper 3/4 Username Information Disclosure Weakness
No description provided by source. source: http://www.securityfocus.com/bid/7110/info An information disclosure weakness has been reported for Qpopper when authenticating. The weakness is due to the fact that if a valid username is sent with a bad password, Qpopper will wait a small amount of tim...