Google Releases Nogotofail Tool to Test Network Security

The last year has produced a rogues’ gallery of vulnerabilities in transport layer security implementations and new attacks on the key protocols, from Heartbleed to the Apple gotofail flaw to the recent POODLE attack. To help developers and security researchers identify applications that are...

Design/Logic Flaw

displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 fixed in Centreon web 2.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 sessionid or 2 templateid parameter, related to the commandline variable...

CVE-2014-7644

The Go MSX MLS aka com.doapps.android.realestate.RE16b9c09c4d5b0e174208f35e7c49f9a0 application 2.3.4.MR3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7703

The Terrorizer Magazine aka com.triactivemedia.terrorizer application @7F08017A for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7802

The Top Roller Coasters Europe 2 aka com.appaapps.top10tallesteuropeanrollercoasters2 application @7F050001 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7587

The Blocked in Free aka com.blueup.blocked application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Blood aka com.sheridan.ash application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7471

The international-arbitration-attorney.com aka com.w0f1d79a1010d819acbee876007d0bebc application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The 100 Beauty Tips aka com.ww100BeautyTipsApp application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Letters to God - soc. network aka com.wPismakBoguLetterstoGod application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The nashaplaneta.su aka com.wNashaPlaneta application 1.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-4437

CVE-2014-4437 affects Apple OS X LaunchServices (pre-10.10). The flaw allows a sandboxed application to bypass restrictions by registering a crafted Content-Type handler for an object. Root cause: the LaunchServices interface allowed sandboxed apps to set content-type handlers, enabling sandbox b...

Information disclosure

The Arabic Troll Football aka com.hamoosh.ArabicTrollFootball application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6996

The CVE-2014-6996 entry concerns the Android app “Martial Arts Battle Card” (com.tapenjoy.zjh.tw) version 1.0.9, where SSL/TLS connections do not verify X.509 certificates. The underlying issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted cert...

CVE-2014-6953

The AFTERLIFE WITH ARCHIE aka com.afterlifewitharchie.afterlifewitharchie application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Croogo 2.0.0 Cross Site Scripting

------------------------ XSS 1 -------- POST parameters: - dataContacttitle ------------------------ input type="hidden" name="dataTokenkey" value="2627e9e2...

F5 Networks BIG-IP : GnuTLS vulnerability (SOL15637)

The gnutlsciphertext2compressed function in lib/gnutlscipher.c in GnuTLS 2.12.23 allows remote attackers to cause a denial of service buffer over-read and crash via a crafted padding length. NOTE: this might be due to an incorrect fix for CVE-2013-0169. C Tenable Network Security, Inc. The...

Square: CSRF on adding clients

Authenticate to an account. 2. Trick the victim to submit the following HTML: input type="hidden"...

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

It was found that the SecurityTokenService STS, provided as a part of Apache CXF, could under certain circumstances accept invalid SAML tokens as valid. A remote attacker could use a specially crafted SAML token to gain access to an application that uses STS for validation of SAML tokens...

CVE-2014-6805

The CVE-2014-6805 entry concerns the Android Weibo (magic.weibo) app version 1.2, which does not verify X.509 certificates when establishing SSL connections. This behavior allows man-in-the-middle attackers to spoof HTTPS servers and obtain sensitive information via a crafted certificate. Per ava...