NAT32 2.2 Build 22284 - Cross-Site Request Forgery Vulnerability

Exploit for windows platform in category web applications + Credits: hyp3rlinx Vendor: ============= www.nat32.com Product: =========== NAT32 Build 22284 NAT32® is a versatile IP Router implemented as a WIN32 application. Vulnerability Type: =================== Remote Command Execution CSRF CVE...

Match Group Tinder iOS app and Tinder Android app information disclosure vulnerability

Match Group Tinder iOS app and Tinder Android app are both products of Match Group, Inc.Tinder iOS app is an online dating app based on iOS platform.Tinder Android app is an online dating app based on Android. A security vulnerability exists in the Match Group Tinder iOS app and Tinder Android ap...

Code injection

Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network traffic...

CVE-2018-6017

Unencrypted transmission of images in Tinder iOS app and Tinder Android app allows an attacker to extract private sensitive information by sniffing network traffic...

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download Vendor: NEC Corporation Product web page: http://www.nec.com Affected version: WebPro =10.00 DSP Firmware Version: 12.11.00.02 Summary: NEC's UNIVERGEAr SV9100 is the unified communications UC solution of choice for small and...

NEC Univerge SV9100/SV8100 WebPro 10.0 - Configuration Download Vulnerability

NEC Univerge SV9100/SV8100 WebPro version 10.0 suffers from a remote configuration download vulnerability. The gzipped telephone system configuration file 'config.gz' or 'config.pcpx' that contains the unencrypted data file 'conf.pcpn', can be downloaded by an attacker from the root directory if...

ABB Ellipse information leakage hole reveals vulnerabilities

Ellipse is an EAM software application for asset-intensive industries. ABB Ellipse is vulnerable to an information leakage hole disclosure vulnerability that allows an attacker to discover authentication credentials by sniffing local network traffic when authenticating Ellipse to LDAP/AD using th...

CVE-2017-16731

An Unprotected Transport of Credentials issue was discovered in ABB Ellipse 8.3 through Ellipse 8.9 released prior to December 2017 including Ellipse Select. A vulnerability exists in the authentication of Ellipse to LDAP/AD using the LDAP protocol. An attacker could exploit the vulnerability by...

CVE-2017-14487

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, userid, and token fields in data/data/com.ohmibod.remote2/sharedprefs/OMB.xml...

CVE-2017-14486

The CVE-2017-14486 issue affects the Vibease Wireless Remote Vibrator app (Android) and the Vibease Chat app (iOS). The root cause is cleartext message exchange between the apps and use of the PLAIN SASL mechanism to transmit authentication tokens to Vibease servers, enabling an attacker who can ...

CVE-2017-14486

The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages with other apps and the PLAIN SASL mechanism to send auth tokens to Vibease servers, which allows remote attackers to obtain user credentials, messages, and other sensitive...

Design/Logic Flaw

In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network...

CVE-2017-15998

In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network...

CVE-2017-15998

The CVE concerns the Android app NQ Contacts Backup & Restore version 1.1, which uses DES encryption with a static key to protect transmitted contact data. This practice can allow remote attackers to obtain plaintext data by sniffing network traffic, representing a confidentiality impact describe...

CVE-2017-15998

In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network...

Privilege escalation

In the "Diary with lock" aka WriteDiary application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive...

CVE-2017-15581

In the "Diary with lock" aka WriteDiary application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive...

CVE-2017-15581

In the "Diary with lock" aka WriteDiary application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive...

GHSA-Q6CW-2553-7837 newrelic_rpm Gem Discloses Sensitive Information

Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information database credentials and SQL statements by sniffing the network and deserializing the data...

newrelic_rpm Gem Discloses Sensitive Information

Ruby agent 3.2.0 through 3.5.3.23 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information database credentials and SQL statements by sniffing the network and deserializing the data...