1856 matches found
CVE-2014-4384
Directory traversal vulnerability in the App Installation feature in Apple iOS before 8 allows local users to install unverified apps by triggering code-signature validation of an unintended bundle...
CVE-2014-4384
CVE-2014-4384 affects iOS App Installation (Apple) and describes a path traversal in the App Installation workflow. A local attacker could retarget code signature validation to a different bundle during installation, allowing the installation of an unverified app. Apple’s advisory notes the issue...
Phorum 3.0.7 admin.php3 Unverified Administrative Password Change Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/2271/info Phorum is a popular, free, open source software package originally written by Brian Moon. The package is designed to add chat/bulletin board style interaction between visitors of a web site. A problem with Phoru...
Lexmark laser printers contain multiple vulnerabilities
Overview Certain Lexmark devices are vulnerable to unverified password changes and stored cross-site scripting attacks. Description CWE-620: Unverified Password Change - CVE-2013-6032Certain models of Lexmark laser printers and MarkNet devices are vulnerable to an attack which allows a remote...
jabberd: Prone to unsolicited XMPP Dialback attacks
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a 1 Verify Response or 2 Authorization Response...
CVE-2012-5809
The Groupon Redemptions application for Android does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2012-5825
Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library...
Certificate revocation service failure may cause Opera to show an unverified site as secure – Opera Security Advisories
When accessing secure websites, Opera checks with a number of services to check if the website’s security certificate has been revoked. Normally, if Opera cannot check revocation status, it will not present the site as secure. In some cases, a failure in one of these services can cause Opera not ...
PT-2012-4784 · Jabberd2 · Jabberd2
Name of the Vulnerable Software and Affected Versions: jabberd2 versions 2.2.16 and earlier Description: The issue arises from the lack of verification in s2s/out.c for requests related to XMPP Server Dialback responses. This allows remote XMPP servers to spoof domains by sending either a Verify...
JON: Unapproved agents can connect using the name of an existing approved agent
Red Hat JBoss Operations Network JON before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name...
Design/Logic Flaw
The helper application in Cisco AnyConnect Secure Mobility Client formerly AnyConnect VPN Client before 2.3.185 on Windows, and on Windows Mobile, downloads a client executable file vpndownloader.exe without verifying its authenticity, which allows remote attackers to execute arbitrary code via t...
Code injection
The FC SCSI protocol driver in IBM AIX 6.1 does not verify that a timer is unused before deallocating this timer, which might allow attackers to cause a denial of service system crash via unspecified vectors...
CVE-2010-2526
The cluster logical volume manager daemon clvmd in lvm2-cluster in LVM2 before 2.02.72, as used in Red Hat Global File System GFS and other products, does not verify client credentials upon a socket connection, which allows local users to cause a denial of service daemon exit or logical-volume...
NextApp Echo < 2.1.1 XML Injection Vulnerability
Exploit for multiple platform in category remote exploits ================================================ NextApp Echo ======================================================================== title: NextApp Echo XML Injection Vulnerability program: NextApp Echo vulnerable version: Echo2 2.1.1...
InstallShield Update Agent - Downloads and executes "Rule Scripts" insecurely.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUMMARY InstallShield Update Agent - Remote "Rule Script" Code Execution Vulnerability. OVERVIEW InstallShield Update Agent uses insecure methods of retrieving operational script code from unauthenticated, unverified external sources over HTTP...
Code injection
The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates, which allows remote man-in-the-middle attackers to execute arbitrary code via a Trojan horse update...
phpmycart-sql.txt
PHPMyCart Injection Vulnerability Bug by: h0yt3r Script suffers from a not correctly verified category id variable which is used in SQL Querys. An Attacker can easily get sensitive information from the database by injecting unexpected SQL Querys. We dont get any SQL Errors when the Injection Quer...
PHPMyCart (shop.php cat) Remote SQL Injection Vulnerability
No description provided by source. PHPMyCart Injection Vulnerability Bug by: h0yt3r Script suffers from a not correctly verified category id variable which is used in SQL Querys. An Attacker can easily get sensitive information from the database by injecting unexpected SQL Querys. We dont get any...
MiniHttpServer Web Forum & File Sharing Server 4.0 Add User Exploit
No description provided by source. /================================================================ MiniHTTPServer.NET 's Web Forum & File Sharing Server Power Pack 4 latest version available for sale on their website http://www.minihttpserver.net/bbs/index.php has multiple vulnerabilities with...
[Full-disclosure] Advisory 06/2006: PHProjekt (Remote) Include Vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened-PHP Project www.hardened-php.net -= Security Advisory =- Advisory: PHProjekt Remote Include Vulnerabilities Release Date: 2006/09/29 Last Modified: 2006/09/29 Author: Stefan Esser [email protected] Application: PHProjekt 5.1.1 Severity:...