CVE-2014-4407

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive memory-content information via an application that makes crafted IOKit function calls...

CVE-2014-4367

Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch unintended calls by speaking a telephone number...

Code injection

Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch unintended calls by speaking a telephone number...

CVE-2014-4407

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to obtain sensitive memory-content information via an application that makes crafted IOKit function calls...

CVE-2014-4367

Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attackers to launch unintended calls by speaking a telephone number...

CVE-2014-4367

The CVE-2014-4367 entry affects Apple iOS versions before 8, where Voice Dial can be triggered during upgrade actions. The underlying issue allows a physically proximate attacker to initiate calls by speaking a telephone number, as documented in multiple sources. According to the Apple security b...

CVE-2014-3638

The busconnectionscheckreply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service CPU consumption via a large number of method calls...

CVE-2014-5896

The GlobalTalk- free phone calls aka com.seawolftech.globaltalk application 2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Double free

The GlobalTalk- free phone calls aka com.seawolftech.globaltalk application 2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5896

The GlobalTalk- free phone calls aka com.seawolftech.globaltalk application 2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5896

The CVE-2014-5896 entry concerns the GlobalTalk Android app (version 2.1.4, package com.seawolftech.globaltalk). The issue: the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and steal sensitive information via a crafted cert...

CVE-2014-5840

CVE-2014-5840 affects the Android app forfone (com.forfone.sip) version 1.5.11, where the client does not verify X.509 certificates from SSL servers. This enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The issue is documented acros...

Ubuntu: Security Advisory (USN-2326-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-1565

The mozilla::dom::AudioEventTimeline function in the Web Audio API implementation in Mozilla Firefox before 32.0, Firefox ESR 31.x before 31.1, and Thunderbird 31.x before 31.1 does not properly create audio timelines, which allows remote attackers to obtain sensitive information from process...

CVE-2014-3174

modules/webaudio/BiquadDSPKernel.cpp in the Web Audio API implementation in Blink, as used in Google Chrome before 37.0.2062.94, does not properly consider concurrent threads during attempts to update biquad filter coefficients, which allows remote attackers to cause a denial of service read of...

iPhone vulnerability allows the phone to automatically dial expensive toll-vulnerability warning-the black bar safety net

Developer Andrei Neculaesei,found that although Safari will ask the user whether to make a call, but like Facebook Messenger and Google+, etc. most big name applications are not and the user to confirm whether to dial the telephone, but simply go ahead and make the call. Andrei Neculaesei create ...

Security Advisory - Remote Security Bypass Vulnerability on Huawei Android Devices

Android version 4.1.1 - 4.4.2 is prone to a remote security bypass vulnerability CVE-2013-6272: A vulnerability in the Android system allows an attacker to initiate or terminate arbitrary calls without the callphone permission. After investigation， we confirm that some Huawei smartphone and table...

CVE-2014-3514

activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls...

Design/Logic Flaw

activerecord/lib/activerecord/relation/querymethods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes createwith calls...

CVE-2014-3514

The CVE-2014-3514 entry concerns ActiveRecord in Ruby on Rails (Rails 4.0.x prior to 4.0.9 and 4.1.x prior to 4.1.5). The underlying issue is a bypass of strong parameters protection via crafted input to create_with calls, enabling remote attackers to bypass parameter filtering. Documented refere...