CVE-2014-7536

The Service Academy Forums aka com.tapatalk.serviceacademyforumscom application 3.6.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Service Academy Forums aka com.tapatalk.serviceacademyforumscom application 3.6.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7536

The Service Academy Forums aka com.tapatalk.serviceacademyforumscom application 3.6.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6885

The Academy Sports + Outdoors Visa aka com.usbank.icsmobile.academysports application 1.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Academy Sports + Outdoors Visa aka com.usbank.icsmobile.academysports application 1.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6885

The CVE-2014-6885 vulnerability affects the Academy Sports + Outdoors Visa Android app (package com.usbank.icsmobile.academysports) version 1.18, where SSL servers’ X.509 certificates are not verified. This underpins a man-in-the-middle risk, allowing an attacker to spoof servers and access sensi...

Kebi Academy 2001 Input Validation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7125/info Kebi Academy 2001 does not sufficiently validate input supplied via URI parameters. As a result it has been reported that it is possible to retrieve arbitrary files which are readable by the web server. It has...

Star Wars Jedi Knight: Jedi Academy 1.0.11 Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/12977/info A buffer overflow is present in Jedi Academy that can be exploited remotely by client systems. The overflow is due to the use of the sprintf function in a text visualization procedure, GPrintf. The attacker can...

CaupoShop Pro (2.x/ <= 3.70) Classic 3.01 Local File Include Vulnerability

No description provided by source. CaupoShop Pro 2.x/ = 3.70 Local File Include Vulnerability ----------------------------------------------------------------------------------------- Vuln Softwares : CaupoShop Pro 2.x CaupoShop Classic 3.01 CaupoShop Pro 3.70 Discovered By : Rami Salama Contact ...

Khan Academy: Unchecking hidden parameter is vulnerable to XSS-attack

Unchecking parameter Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them. http://crowdin.khanacademy.org:/login PoC prompt986874"/...

Khan Academy: Suffix of url-path is vulnerable to XSS-attack

PoC http://smarthistory.khanacademy.org/Campin"alert/BigBear/.html Malicious users may inject JavaScript, VBScript, ActiveX, HTML or Flash into a vulnerable application to fool a user in order to gather data from them...

Khan Academy: XSS at http://smarthistory.khanacademy.org

Hi, There is a SWF-based XSS : http://smarthistory.khanacademy.org/assets/flash/cozimo.swf?iceID=%22%29%29catch%28e%29alert%28%27XSS%27%29;// Opening the link would trigger JavaScript execution! Works in possibly any browser with Adobe Flash, i.e - Chrome, Firefox Thanks!...

Khan Academy: Persistent class XSS [the fuck]

Hi, I created a class called : " and it actually worked 0.0. It worked here for me : https://www.khanacademy.org/coach/reports/grid?force=1 Best regards, Olivier Beg...

Khan Academy: https://www.khanacademy.org/coach/reports/activity XSS

Hi, I created a class called ", I hope that you know how to make a class.. After that, when you go to https://www.khanacademy.org/coach/reports/activity and select a class it might not load directly but when you reloud the page it will and persistent. Best regards, Olivier Beg...

Khan Academy: CSRF - Adding/Removing items to cart - shop.khanacademy.org

Hi there, I've discovered a possiblity to remove/add items to a users' cart at shop.khanacademy.org. Details - Host: shop.khanacademy.org - URL: http://shop.khanacademy.org/cart - Affected parameters: updatesPRODUCTID Steps to reproduce - 1. Visit http://shop.khanacademy.org/cart and empty your...

Khan Academy: User guessing/enumeration at sw.khanacademy.org

Hi there, I've discovered a possibility to check whether a specific email address is associated with an account at sw.khanacademy.org. An attacker could use this issue to gather some information about his victim. Details - Host: sw.khanacademy.org - URL: https://sw.khanacademy.org/forgotpw -...

Khan Academy: Lighttpd version disclosure / directory listing

Hello there, the website at http://graphite.khanacademy.org/ isn't configured correctly. It displays the lighttpd version as well the directory contents. You should disable these features in your lighttpd.conf / php.ini. PoC: Index of / Name Last Modified Size Type Parent Directory/ - Directory...

Khan Academy: Possible clickjacking at shop.khanacademy.org

Hello there, the website at shop.khanacademy.org isn't protected against clickjacking properly. PoC curl -L -I http://shop.khanacademy.org/ HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Apr 2014 00:33:39 GMT Content-Type: text/html; charset=utf-8 Vary: Accept-Encoding Status: 200 OK X-XSS-Protectio...

Khan Academy: Stored XSS {dangerous?} https://www.khanacademy.org/coach/roster/?listId=allStudents

Hi, when you go to https://www.khanacademy.org/coach/roster/?listId=allStudents and press on add class you have the possebility to add a class obvious. when you name it " it will stay persistent. quite dangerous Best regards, Olivier Beg...

Khan Academy: Full Path Disclosure on [smarthistory.khanacademy.org]

Hello, I have found a full path disclosure on a website that runs a wordpress installation. There isn't much to explain about this bug, as it's pretty self explanatory. What an attack can do with this bug is identify the full path, and the user the site is running under. If the attacker finds a...