CVE-2014-9264

SAP SQL Anywhere .NET Data Provider is affected by a stack-based buffer overflow when processing column aliases, allowing remote code execution. The issue arises from insufficient boundary checks in handling of column aliases (as detailed across ZDI advisories ZDI-14-412, ZDI-14-413, ZDI-14-414, ...

CVE-2014-9264

Stack-based buffer overflow in the .NET Data Provider in SAP SQL Anywhere allows remote attackers to execute arbitrary code via a crafted column alias...

SAP SQL Anywhere .NET Data Provider Code Execution Vulnerabilities

This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere. The specific flaw exists within the handling of the REPLICATE function. If an application allows untrusted input to be used as the length of a REPLICATE functio...

THC-Hydra 8.1 - Network Logon Cracker

A very fast network logon cracker which support many different services. See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept...

SAP SQL Anywhere .NET Data Provider Column Alias Stack Buffer Overflow Code Execution Vulnerability

This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere. The specific flaw exists within the handling of column aliases. If an application allows untrusted input to be used as the column alias in a query, even if the...

SAP SQL Anywhere .NET Data Provider SPACE Function Heap Overflow Code Execution Vulnerability

This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere. The specific flaw exists within the handling of the SPACE function. If an application allows untrusted input to be used as the length of a SPACE function in a...

SAP SQL Anywhere .NET Data Provider Malformed Integer Stack Buffer Overflow Code Execution Vulnerability

This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere. The specific flaw exists within the handling of a malformed integer constant. If an application allows untrusted input to be used in a query, even if the input ...

SAP SQL Anywhere .NET Data Provider REPLICATE Function Heap Overflow Code Execution Vulnerability

This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere. The specific flaw exists within the handling of the REPLICATE function. If an application allows untrusted input to be used as the length of a REPLICATE functio...

CVE-2014-6768

The Anywhere Anytime Yoga Workout aka com.bayart.yoga application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6768

The CVE-2014-6768 entry concerns the Anywhere Anytime Yoga Workout (com.bayart.yoga) Android app, version 1.0. The root cause is that the app does not verify X.509 certificates when establishing SSL/TLS connections, which enables man-in-the-middle attackers to spoof servers and exfiltrate sensiti...

CVE-2014-5954

The State Bank Anywhere aka com.sbi.SBIFreedomPlus application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The State Bank Anywhere aka com.sbi.SBIFreedomPlus application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5954

The CVE-2014-5954 entry concerns the State Bank Anywhere (com.sbi.SBIFreedomPlus) Android app 2.0.1, which does not verify X.509 certificates from SSL servers. This certificate validation failure enables man-in-the-middle attackers to spoof SSL servers and obtain sensitive information via a craft...

CVE-2014-5954

The State Bank Anywhere aka com.sbi.SBIFreedomPlus application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

SAP Afaria 7 XcListener - Missing authorization check

Application: SAP Afaria 7.0.6001.5 Vendor URL: http://www.sap.com Bugs: Missing authorization check Reported: 09.12.2014 Vendor response: 10.12.2014 Date of Public Advisory: 15.03.2015 Reference: SAP Security Note 2134905 Authors: Vahagn Vardanyan ERPScan Vulnerability information Class: DoS...

Sybase SQL Anywhere 11 and 16 - DoS

Application: Sybase SQL Anywhere 11 and 16 Vendor URL: Bugs: DoS Reported: 09.12.2014 Vendor response: 10.12.2014 Date of Public Advisory: 15.03.2015 Reference: SAP Security Note 2108161 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: DoS CWE-122 Impact: DoS Remotely Exploitabl...

CVE-2014-5704

The DISH Anywhere aka com.sm.SlingGuide.Dish application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The DISH Anywhere aka com.sm.SlingGuide.Dish application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5704

The CVE-2014-5704 entry applies to the DISH Anywhere app (com.sm.SlingGuide.Dish) for Android, version 3.5.10. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and access sensitive information via a crafte...

CVE-2014-5704

The DISH Anywhere aka com.sm.SlingGuide.Dish application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...