Cross site request forgery (csrf)

atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name...

PYSEC-2014-27

registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface...

CVE-2012-5486

CVE-2012-5486 - HP: ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19 (used in Plone before 4.3 beta 1) allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character. Affected components: Zope 2 series up to 2.13.18; Plone deployments including the Plone before...

CVE-2014-6827

The DK ONLINE Beta aka com.sgmobile.dkonline application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The DK ONLINE Beta aka com.sgmobile.dkonline application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6827

The CVE-2014-6827 entry involves the DK ONLINE Beta Android app (com.sgmobile.dkonline) version 1.0.2 where SSL servers’ X.509 certificates are not verified. This allows MITM attackers to spoof servers and read sensitive data via crafted certificates. The publicly available data confirms the vuln...

PT-2014-7504

Name of the Vulnerable Software and Affected Versions DK ONLINE Beta aka com.sgmobile.dkonline version 1.0.2 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...

CVE-2014-6827: Undefined Security Weakness

The DK ONLINE Beta aka com.sgmobile.dkonline application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Grasshopper Beta aka com.grasshopper.dialer application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6751

The Grasshopper Beta aka com.grasshopper.dialer application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6751

The CVE-2014-6751 entry covers the Grasshopper Beta (com.grasshopper.dialer) Android app version 2.1, which does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attacks to spoof servers and exfiltrate sensitive information. The NVD rep...

PT-2014-7429

Name of the Vulnerable Software and Affected Versions The Grasshopper Beta aka com.grasshopper.dialer application version 2.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify...

CVE-2014-6751: Undefined Security Weakness

The Grasshopper Beta aka com.grasshopper.dialer application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5943

The CVE-2014-5943 entry concerns LabMSF Antivirus beta (aka com.ReSync.RNGN) 1.0.2 for Android, which fails to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Supported documents confi...

PT-2014-6928

Name of the Vulnerable Software and Affected Versions LabMSF Antivirus beta aka com.ReSync.RNGN version 1.0.2 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates...

PT-2014-2312 · Plone +1 · Plone +1

Name of the Vulnerable Software and Affected Versions: Plone versions prior to 4.2.3 Plone version 4.3 before beta 1 Description: The issue allows remote attackers to execute Python code via unspecified vectors, related to the admin interface. This is possible due to a problem in the...

PT-2014-2324 · Plone Foundation +1 · Plone +1

Name of the Vulnerable Software and Affected Versions: Plone versions prior to 4.2.3 Plone versions 4.3 prior to beta 1 Description: The issue allows remote attackers to enumerate user account names via a crafted URL. This is related to the membership tool.py script. Recommendations: For Plone...

PT-2014-2326 · Plone +1 · Plone +1

Name of the Vulnerable Software and Affected Versions: Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1 Description: The issue allows remote attackers to cause a denial of service, specifically memory consumption, via a large value. This is related to the formatColumns function...

MyBB 1.8 Beta 3 Cross Site Scripting / SQL Injection

Title: MyBB 1.8 Beta 3 - Cross Site Scripting & SQL Injection Google Dork: intext:"Powered By MyBB" Date: 15.08.2014 Author: DemoLisH Vendor Homepage: http://www.mybb.com/ Software Link: http://www.mybb.com/downloads Version: 1.8 - Beta 3 Contact: [email protected] a Cross Site Scripting in...

WordPress GeoPlaces4 and GeoPlaces4 Beta Themes - Shell Upload

These WordPress themes are prone to a shell upload vulnerability. It allows an attacker to execute arbitrary PHP code. Solution Update the theme...