CVE-2014-7070: Undefined Security Weakness

The Air War Hero aka com.dev.airwar application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6434

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the 1 a1 or 2 a2 parameter in a restart action...

CVE-2014-6433

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

Information disclosure

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

CVE-2014-6434

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the 1 a1 or 2 a2 parameter in a restart action...

CVE-2014-6433

CVE-2014-6433 concerns gpExec in the GoPro HERO 3+. The vulnerability arises from insufficient parameter validation for the a1/a2 parameters when the start action is invoked (c1/c2 set to start), enabling remote code execution. The primary publicly referenced detail is the ZDI advisory (ZDI-14-34...

CVE-2014-6434

The CVE-2014-6434 issue affects GoPro HERO 3+ via gpExec. The vulnerability arises from insufficient parameter validation on the a1/a2 parameters when c1/c2 are set to restart, enabling remote code execution. Impact is remote execution of arbitrary commands on vulnerable devices without authentic...

CVE-2014-6433

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

CVE-2014-6433: Improper Control of Generation of Code

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary files via a the 1 a1 or 2 a2 parameter in a start action...

CVE-2014-6434: Improper Neutralization of Special Elements used in an OS Command

gpExec in GoPro HERO 3+ allows remote attackers to execute arbitrary commands via a the 1 a1 or 2 a2 parameter in a restart action...

PT-2014-7218

Name of the Vulnerable Software and Affected Versions GoPro HERO 3+ affected versions not specified Description The issue allows remote attackers to execute arbitrary files. This is achieved via the a1 or a2 parameter in a start action. No information is provided about the estimated number of...

PT-2014-7219

Name of the Vulnerable Software and Affected Versions GoPro HERO 3+ affected versions not specified Description The issue allows remote attackers to execute arbitrary commands. This can be achieved via the a1 or a2 parameter in a restart action. Recommendations At the moment, there is no...

(0Day) GoPro HERO 3+ gpExec start Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GoPro HERO 3+. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gpExec component. This component performs insufficient parameter validation on the...

(0Day) GoPro HERO 3+ gpExec restart Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of GoPro HERO 3+. Authentication is not required to exploit this vulnerability. The specific flaw exists within the gpExec component. This component performs insufficient parameter validation on the...

CVE-2014-5848

The Dubstep Hero aka com.electricpunch.dubstephero application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Dubstep Hero aka com.electricpunch.dubstephero application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5848

The Dubstep Hero aka com.electricpunch.dubstephero application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5848

CVE-2014-5848 affects the Dubstep Hero Android app (com.electricpunch.dubstephero) version 1.9. The issue is failure to verify X.509 certificates when establishing SSL connections, which allows a man-in-the-middle to spoof servers and potentially exfiltrate sensitive data via a crafted certificat...

PT-2014-6833

Name of the Vulnerable Software and Affected Versions The Dubstep Hero aka com.electricpunch.dubstephero version 1.9 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...

CVE-2014-5848: Undefined Security Weakness

The Dubstep Hero aka com.electricpunch.dubstephero application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...