CVE-2013-6161

CVE-2013-6161 is rejected/not used; this CVE ID does not represent an active vulnerability entry.

PT-2015-5376

Name of the Vulnerable Software and Affected Versions Siemens SPCanywhere affected versions not specified Description The issue concerns the lack of encryption during lookups of system ID to IP address mappings in the Siemens SPCanywhere application. This allows man-in-the-middle attackers to...

KLA10464 Multiple vulnerabilities in Mozilla products

Multiple serious vulnerabilities have been found in Mozilla products. Malicious users can exploit these vulnerabilities to cause denial of service, gain privilleges, obtain sensitiv information, execute arbitrary code, spoof user interface or read local files. Below is a complete list of...

Ilch CMS Cross Site Request Forgery

Affected software: Ilch cms Type of vulnerability: csrf URL: http://www.ilch.de/ Discovered by: Provensec Website: http://www.provensec.com Description: Ilch cms profile field csrf Proof of concept http://demo.opensourcecms.com/ilch/admin.php?profilefields online demo Above field was vulnerable t...

PT-2015-4390

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server 2003 SP2 Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold an...

Pilot CMS Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

CMS Pylot suffers from cross site request forgery and cross site scripting vulnerabilities. These are Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities in CMS Pylot "Ïèëîò" on Russian. It's Ukrainian commercial CMS from Delta-X. ------------------------- Affected products:...

CMS Pylot Cross Site Request Forgery / Cross Site Scripting

Hello list! These are Cross-Site Scripting and Cross-Site Request Forgery vulnerabilities in CMS Pylot "Ïèëîò" on Russian. It's Ukrainian commercial CMS from Delta-X. ------------------------- Affected products: ------------------------- Vulnerable are all versions of CMS Pylot. Developers from...

PT-2014-7090

Name of the Vulnerable Software and Affected Versions IBM WebSphere Service Registry and Repository WSRR versions 7.0.0 through 7.0.0.4 Description The issue allows remote authenticated users to obtain sensitive information due to a lack of access-control checks for contained objects...

Twiki/Fosswiki Unauthenticated Arbitrary File Upload (CVE-2014-7237)

An arbitrary file upload vulnerability has been reported in Twiki/Fosswiki. The vulnerability is due to lack of sanitization for user-supplied data. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

PT-2014-7162

Name of the Vulnerable Software and Affected Versions Microsoft Active Directory Federation Services AD FS versions 2.0 through 3.0 Description The issue arises when a configured SAML Relying Party lacks a sign-out endpoint, leading to improper processing of logoff actions. This makes it easier f...

PT-2014-7058

Name of the Vulnerable Software and Affected Versions IBM Notes Traveler versions prior to 9.0.1.3 for Android Description The issue makes it easier for remote attackers to obtain sensitive information by sniffing the network during a session in which the user had intended to use HTTPS, due to th...

Mulesoft ESB Runtime 3.5.1 Privilege Escalation / Code Execution Vulnerabilities

Mulesoft ESB Runtime version 3.5.1 suffers from an authenticated privilege escalation vulnerability that can lead to remote code execution. Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation → Remote Code Execution Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to...

PT-2014-8213

Name of the Vulnerable Software and Affected Versions The Indian Jeweller aka com.magzter.indianjeweller application version 3.0 for Android Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application doe...

PT-2014-8170

Name of the Vulnerable Software and Affected Versions com.wBilingualMagicBallRelajo version 0.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL...

PT-2014-8155

Name of the Vulnerable Software and Affected Versions com.wPegasusAirlines application version 0.84.13503.96707 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...

PT-2014-8245

Name of the Vulnerable Software and Affected Versions Health assistance service aka net.nttcloud.ft.karada version 2.4.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

CVE-2014-7387: Undefined Security Weakness

The ACC Advocacy Action aka com.acc.app.android.ui application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7895

Name of the Vulnerable Software and Affected Versions Ali Visual aka com.ali.visual version 1.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL...

PT-2014-7769

Name of the Vulnerable Software and Affected Versions Talk Radio Europe aka com.nobexinc.wls 31251464.rc version 3.3.10 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

CVE-2014-4428: Undefined Security Weakness

Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing...