Ubisoft Uplay 5.0 Insecure File Permissions Local Privilege Escalation

Summary Uplay PC is a desktop client which replaces individual game launchers previously used for Ubisoft games. With Uplay PC, you have all your Uplay enabled games and Uplay services in the same place and you get access to a whole new set of features for your PC games. Description Uplay for PC...

Like a Nesting Doll, Vawtrak Malware Has Many Layers

Researchers have peeled back more layers on Vawtrak, a relatively new banking Trojan so complex that those who have taken it apart have likened it to a Matryoshka, or Russian nesting doll. Virus Bulletin published a deep dive on the malware penned by Raul Alvarez, a researcher with Fortinet,...

CVE-2015-1054

Cross-site scripting XSS vulnerability in the Games feature in Crea8Social 2.0 allows remote authenticated users to inject arbitrary web script or HTML via the Game Content field in Add Game...

Crea8Social 2.0 - Cross-Site Scripting Change Interface

Crea8Social 2.0 - Cross-Site Scripting Change Interface Exploit Title: Crea8Social v.2.0 XSS Change Interface Google Dork: intext:Copyright © 2014 CreA8social. Date: January 3, 2015 Exploit Author: r0seMary Vendor Homepage: http://crea8social.com Software Link:...

Crea8Social 2.0 Cross Site Scripting

Exploit Title: Crea8Social v.2.0 XSS Change Interface Google Dork: intext:Copyright © 2014 CreA8social. Date: January 3, 2015 Exploit Author: r0seMary Vendor Homepage: http://crea8social.com Software Link: http://codecanyon.net/item/crea8social-php-social-networking-platform-v20/9211270 or...

BitRaider Streaming Client 1.3.3.4098 Local Privilege Escalation Vulnerability

BitRaider Streaming Client version 1.3.3.4098 suffers from a local privilege escalation vulnerability. BitRaider Streaming Client 1.3.3.4098 Local Privilege Escalation Vulnerability Vendor: BitRaider, LLC Product web page: http://www.bitraider.com Affected version: 1.3.3.4098 Summary: BitRaider i...

BitRaider Streaming Client 1.3.3.4098 Local Privilege Escalation Vulnerability

Summary BitRaider is a video game streaming and download service. Description BitRaider contains a flaw that leads to unauthorized privileges being gained. The issue is due to the program granting improper permissions with the 'F' flag for the 'Users' group, which makes the entire 'BitRaider'...

BitRaider Streaming Client 1.3.3.4098 - Local Privilege Escalation

BitRaider Streaming Client 1.3.3.4098 Local Privilege Escalation Vulnerability Vendor: BitRaider, LLC Product web page: http://www.bitraider.com Affected version: 1.3.3.4098 Summary: BitRaider is a video game streaming and download service. Desc: BitRaider contains a flaw that leads to...

PsychoStats < 2.2.4 Beta - Cross Site Scripting

PsychoStats Cross Site Scripting Vendor: Jason Morriss Product: PsychoStats Version: = 2.2.4 Beta Website: http://www.psychostats.com/ BID: 12089 CVE: CVE-2004-1417 OSVDB: 12560 SECUNIA: 13619 PACKETSTORM: 35502 Description: PsychoStats is a statistics generator for games. Currently there is...

CVE-2014-7757

The Awful Ninja Game aka com.absolutelyawfulapplications.awfulninjagame application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7757

The Awful Ninja Game aka com.absolutelyawfulapplications.awfulninjagame application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Awful Ninja Game aka com.absolutelyawfulapplications.awfulninjagame application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7757

The CVE-2014-7757 entry concerns the Android app “The Awful Ninja Game” (com.absolutelyawfulapplications.awfulninjagame) version 1.0.23, where SSL/TLS connections fail to verify X.509 certificates from servers. Root cause: missing certificate verification, enabling MITM attackers to spoof servers...

CVE-2014-7519

The Cycling Manager Game Cff aka com.CyclingManagerGame application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Cycling Manager Game Cff aka com.CyclingManagerGame application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7519

The CVE-2014-7519 entry concerns the Android app Cycling Manager Game Cff (com.CyclingManagerGame) 1.0, which fails to verify X.509 certificates from SSL servers. This allows a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certificate, as documented in the NVD ...

CVE-2014-7407

The Game Day Tix aka com.xcr.android.mygamedaytickets application 2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7391

The Synx addictive puzzle game aka us.synx.mobile.play application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Game Day Tix aka com.xcr.android.mygamedaytickets application 2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7407

The CVE-2014-7407 entry documents a vulnerability in the Game Day Tix Android app (package com.xcr.android.mygamedaytickets) version 2.4, where the app does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information vi...