CVE-2014-7049

The CVE-2014-7049 entry concerns the SomTodo (com.somcloud.somtodo) Android app version 2.0.3, which does not verify X.509 certificates from SSL servers. This trust weakness allows a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certificate. The vulnerability a...

CVE-2014-7049: Undefined Security Weakness

The SomTodo - Task/To-do widget aka com.somcloud.somtodo application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7724

Name of the Vulnerable Software and Affected Versions The SomTodo - Task/To-do widget aka com.somcloud.somtodo version 2.0.3 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information v...

PT-2014-8349

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.17 Description The issue allows local users to cause a denial of service, specifically a loss of writability, by manipulating certain system calls and flags. This is due to the do umount function not requiring t...

Information disclosure

The Show do Milhao 2014 aka br.com.lgrmobile.sdm application 1.4.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5563

The CVE concerns the Android application Show do Milhao 2014 (package br.com.lgrmobile.sdm), version 1.4.6. The root cause is that the app does not verify X.509 certificates from SSL servers, which enables a man‑in‑the‑middle attacker to spoof servers and obtain sensitive information via a crafte...

CVE-2014-5563: Undefined Security Weakness

The Show do Milhao 2014 aka br.com.lgrmobile.sdm application 1.4.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-6214

Name of the Vulnerable Software and Affected Versions ManageEngine EventLog Analyzer versions prior to 9.0 build 9002 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various...

CVE-2014-4930: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in event/index2.do in ManageEngine EventLog Analyzer before 9.0 build 9002 allow remote attackers to inject arbitrary web script or HTML via the 1 width, 2 height, 3 url, 4 helpP, 5 tab, 6 module, 7 completeData, 8 RBBNAME, 9 TC, 10 rtype, 11...

Privacy Badger Extension Blocks Tracking Through Social Icons

Online tracking has been a thorny problem for years, and as Web security companies, browser vendors and users have become more aware of the problem and smarter about how to defend themselves, ad companies and trackers have responded in kind. The advent of social networks has made it far easier fo...

PT-2014-6090

Name of the Vulnerable Software and Affected Versions osTicket versions prior to 1.9.2 Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via several fields, including the Phone Number...

CVE-2014-4744: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in osTicket before 1.9.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Phone Number field to open.php or 2 Phone number field, 3 passwd1 field, 4 passwd2 field, or 5 do parameter to account.php...

PerfectView CRM Cross Site Scripting

Affected software: PerfectView CRM Description: PerfectView CRM is a software for Relationship Management, Marketing & Sales Type of vulnerability: XSS Persistent URL: http://perfectviewcrm.com Discovered by: Provensec Website: http://www.provensec.com Description: PerfectView is prone to a...

DO-CMS Multiple SQL Injection Vulnerabilities

No description provided by source. DO-CMS Multiple Sql Injection Vulnerability ==================================================================== .:. Author : AtT4CKxT3rR0r1ST [email protected] .:. Script : http://www.do-cms.com/ .:. Dork : Powered by DO-CMS === Exploit ===...

DO-CMS 3.0 'p' Parameter Multiple SQL Injection Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/32906/info DO-CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could allow an attacker to...

DEBIAN-CVE-2014-4617

The douncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service infinite loop via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence...

Yahoo Drops Support for Do Not Track

Yahoo, one of the first large Web companies to recognize the Do Not Track header from browsers on its properties, has now backtracked and said it will no longer support DNT. Officials said the lack of an industry standard for DNT that’s effective led to the decision. DNT is an option in the major...

PT-2014-1877

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.x through 1.0.1g Description The issue is related to the do ssl3 write function in s3 pkt.c when SSL MODE RELEASE BUFFERS is enabled. It does not properly manage a buffer pointer during certain recursive calls, allowing remo...

CVE-2012-4410

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none...

PT-2014-4351

Name of the Vulnerable Software and Affected Versions Xen versions 4.2.x through 4.4-RC Description The issue is related to the do send and do recv functions in io.c in libvchan, which allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes...