84 matches found
High-Severity TinyMCE Cross-Site Scripting Flaw Fixed
A high-severity flaw has been disclosed in TinyMCE, an open-source text editor used in the content management systems CMS of websites. The recently patched flaw could have been potentially exploited remotely by attackers to gain administrative privileges to websites. TinyMCE, developed by Tiny...
JVN#93167107: Android App "Mercari" (Japan version) vulnerable to arbitrary method execution of Java object
Android App "Mercari" Japan version provided by Mercari, Inc. contains vulnerability which may allow arbitrary Java method execution CWE-749 due to inadequate restrictions on addJavascriptInterface of WebView class. Impact An arbitrary method of a Java object may be executed by a remote attacker...
[SECURITY] Fedora 31 Update: python39-3.9.0~a2-1.fc31
Python 3.9 package for developers. This package exists to allow developers to test their code against a newer version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, update your Fedora to a newer version once Python 3.9 is stable...
CVE-2019-13466
Western Digital SSD Dashboard before 2.5.1.0 and SanDisk SSD Dashboard before 2.5.1.0 have Incorrect Access Control. The “generate reports” archive is protected with a hard-coded password. An application update that addresses the protection of archive encryption is available...
CVE-2019-13466
Concretely affected: Western Digital SSD Dashboard and SanDisk SSD Dashboard prior to version 2.5.1.0. Vulnerability: Incorrect access control where the generate reports archive is protected with a hard-coded password. Root cause: insufficient access restrictions for archive generation. Impact: p...
HPSBGN03623 rev. 1 - Exposure of Application Configuration Details - Samsung Mobile Print (Android)
Potential Security Impact Application's configuration details exposed Source: HP, HP Product Security Response Team PSRT Reported by: Akshay Jain Appknox VULNERABILITY SUMMARY A potential security vulnerability caused by incomplete obfuscation of application configuration information. HP has no...
JVN#57806517: Android App "Tootdon for Mastodon" fails to verify SSL server certificates
Android App "Tootdon for Mastodon" provided by Tsukurito, Inc. fails to verify SSL server certificates CWE-295. Impact A man-in-the-middle attack may allow an attacker to obtain and/or alter a content of communication. Solution Update the Application Update to the latest version according to the...
JVN#11622218: iChain Insurance Wallet App for iOS vulnerable to directory traversal
iChain Insurance Wallet App for iOS provided by iChain, Inc. uses the old version of cordova-plugin-ionic-webview, and inherits a directory traversal vulnerability CWE-22, CVE-2018-16202. Impact A remote attacker may obtain an arbitrary file such as a file related to an application on iOS device...
Critical OkCupid Flaw Exposed Daters to App Takeovers
A critical flaw in the OkCupid app has been found that could allow a bad actor to steal credentials, launch man-in-the-middle attacks or completely compromise the victim’s application. This is separate from the OKCupid account-takeover incident reported earlier in the week, but it does fit the...
Cross site request forgery (csrf)
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could explo...
JVN#77409513: DHC Online Shop App for Android fails to verify SSL server certificates
DHC Online Shop App for Android provided by DHC Corporation fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Application Update to the latest version according to the information provid...
JVN#83671755: KINEPASS App fails to verify SSL server certificates
KINEPASS App provided by T・JOY CO.,LTD fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Application Update to the latest version according to the information provided by the developer...
RBB SPEED TEST App fails to verify SSL server certificates
Overview RBB SPEED TEST App provided by IID, Inc. fails to verify SSL server certificates. DigiGnome reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attack may allow an attacker to...
JVN#82619692: Access CX App fails to verify SSL server certificates
Access CX App provided by NISSAN SECURITIES CO., LTD. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Application Update to the latest version according to the information provided by...
JVN#43529183: Jetstar App for iOS fails to verify SSL server certificates
Jetstar App for iOS provided by Jetstar Airways Pty Ltd. fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the application Update to the latest version according to the information provided ...
Apple iOS v9.x - Application Update Loop Pass Code Bypass
Document Title: =============== Apple iOS v9.x - Application Update Loop Pass Code Bypass References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1711 View Video: https://www.youtube.com/watch?v=V-9lE1L3nq0 Apple Follow-up ID: 631627909 Advisory:...
Apple iOS v9.x - Application Update Loop Pass Code Bypass
Document Title: =============== Apple iOS v9.x - Application Update Loop Pass Code Bypass References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1711 View Video: https://www.youtube.com/watch?v=V-9lE1L3nq0 Apple Follow-up ID: 631627909 Advisory:...
Apple iOS v9.x - Application Update Loop Pass Code Bypass
Document Title: =============== Apple iOS v9.x - Application Update Loop Pass Code Bypass References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1710 Apple Follow-up ID: 631627909 Video: http://www.vulnerability-lab.com/getcontent.php?id=1711 Vulnerability...
Good for Enterprise 2.2.2.1611 - XSS Vulnerability
Exploit for hardware platform in category web applications The vulnerable versions are v2.2.2.1611 and earlier Proof of Concept: HTML Email including the following payload will execute Javascript statements when the victim open the email using the vulnerable version. Payload: alert'XSS Here'...
Critical: Red Hat Security Advisory: rubygem-activesupport security update
An updated rubygem-activesupport package that fixes one security issue is now available for Red Hat OpenShift Enterprise 1.0. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...