Xplico v0.6.1 - Network Forensic Analysis Tool (NFAT)

"The goal of Xplico is extract from an internet traffic capture the applications data contained. For example, from a pcap file Xplico extracts each email POP, IMAP, and SMTP protocols, all HTTP contents, each VoIP call SIP, FTP, TFTP, and so on. Xplico isn't a network protocol analyzer. Xplico is...

CVE-2010-4213

The Bank of America application 2.12 for Android stores a security question's answer in cleartext, which might allow physically proximate attackers to obtain sensitive information by reading application data...

CVE-2010-4212

The USAA application 3.0 for Android stores a mirror image of each visited web page, which might allow physically proximate attackers to obtain sensitive banking information by reading application data...

Code injection

Unspecified vulnerability in the HP MagCloud app before 1.0.5 for the iPad allows remote attackers to read and modify MagCloud application data via unknown vectors...

CVE-2010-2711

Unspecified vulnerability in the HP MagCloud app before 1.0.5 for the iPad allows remote attackers to read and modify MagCloud application data via unknown vectors...

Code injection

The IBM BladeCenter with Advanced Management Module AMM firmware before bpet50g does not properly perform interrupt sharing for USB and iSCSI, which allows remote attackers to cause a denial of service management module reboot via TCP packets with malformed application data...

Design/Logic Flaw

The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted...

CVE-2009-1754

The CVE-2009-1754 entry describes Android 1.5 (CRB42) allowing a package to share a UID without proper verification of developer certificates during installation. This enables a remote, user‑assisted attacker to access data from other apps by installing a package that uses a sharedUserId with arb...

CVE-2009-1754

The PackageManagerService class in services/java/com/android/server/PackageManagerService.java in Android 1.5 through 1.5 CRB42 does not properly check developer certificates during processing of sharedUserId requests at an application's installation time, which allows remote user-assisted...

Ubuntu 5.04 : pike7.6 vulnerability (USN-367-1)

A SQL injection was discovered in Pike's PostgreSQL module. Applications using a PostgreSQL database and uncommon character encodings could be fooled into running arbitrary SQL commands, which could result in privilege escalation within the application, application data exposure, or denial of...

OpenCMS 6.06.2 - Multiple Unauthorized Access Vulnerabilities

OpenCMS 6.06.2 - Multiple Unauthorized Access Vulnerabilities source: https://www.securityfocus.com/bid/19174/info OpenCMS is prone to multiple unauthorized-access vulnerabilities because it fails to properly authenticate users when performing administrative tasks. An attacker can exploit these...

Hogstorps Guestbook 2.0 - Unauthorized Access

source: https://www.securityfocus.com/bid/18205/info Hogstorps guestbook is prone to an access-authorization vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. An attacker can exploit this issue to delete and modify application data. This...

Hogstorps Guestbook 2.0 - Unauthorized Access

Hogstorps Guestbook 2.0 - Unauthorized Access source: https://www.securityfocus.com/bid/18205/info Hogstorps guestbook is prone to an access-authorization vulnerability. The issue occurs because the affected script fails to prompt for authentication credentials. An attacker can exploit this issue...

DCP-Portal 6.1.1 - Multiple SQL Injections

DCP-Portal 6.1.1 - Multiple SQL Injections source: https://www.securityfocus.com/bid/12573/info DCP-Portal is reportedly affected by multiple SQL injection vulnerabilities. These issues exist because the application fails to properly sanitize user-supplied input before using it in SQL queries...

osCommerce 2.1 - Remote File Inclusion

osCommerce 2.1 - Remote File Inclusion source: https://www.securityfocus.com/bid/5037/info osCommerce is prone to an issue which may allow remote attackers to include arbitrary files located on remote servers. If the remote file is a PHP script, this may allow for execution of attacker-supplied P...

ftp-ozone.c.txt

/ ftp-ozone.c Demonstrate a basic layer violation in "stateful" firewall inspection of application data within IP packets - @$@$!: http://www.checkpoint.com/techsupport/alerts/pasvftp.html Dug Song / include include include include include include include include include include include include...