CVE-2014-9115

SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...

CVE-2014-9115

SQL injection vulnerability in the ratepicture function in include/functionsrate.inc.php in Piwigo before 2.5.5, 2.6.x before 2.6.4, and 2.7.x before 2.7.2 allows remote attackers to execute arbitrary SQL commands via the rate parameter to picture.php, related to an improper data type in a...

PT-2014-8834

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.5.5 Piwigo versions 2.6.x prior to 2.6.4 Piwigo versions 2.7.x prior to 2.7.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the rate parameter to "picture.php". This is related t...

PT-2014-8851

Name of the Vulnerable Software and Affected Versions Drupal Services module versions 7.x-3.x before 7.x-3.10 Description The issue allows remote attackers to gain access through a brute-force attack on the administrative password due to improper rate limiting of authentication attempts...

Piwigo 'rate' Parameter SQLi Vulnerability

Piwigo is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:piwigo:piwigo";...

CVE-2014-4435

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

Design/Logic Flaw

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

CVE-2014-4435

The "iCloud Find My Mac" feature in Apple OS X before 10.10 does not properly enforce rate limiting of lost-mode PIN entry, which makes it easier for physically proximate attackers to obtain access via a brute-force attack involving a series of reboots...

CVE-2014-4435

The CVE-2014-4435 entry concerns iCloud Find My Mac on macOS prior to 10.10, where rate limiting on the Lost Mode PIN was not properly enforced, enabling brute‑force access via a series of reboots for users in proximity. Connected sources corroborate that the issue affects macOS OS X pre-10.10 an...

High-Volume, High-Rate DDoS Attacks Persist

As expected, the numbers back up the continued proliferation of both high-volume and high-rate distributed denial of service attacks – like the ones executed via NTP amplification – over the last few months. NSFOCUS, a security firm that measures DDoS traffic, released its Mid-Year Threat Report...

IRCCloud: Weak password policy

Hi there, I noticed that the website does not prevent an user from using this email address as a password. This can lead to some poor password decisions on the clientside. Steps to reproduce - 1. Create a new account and use the email address as the password. - 2. Reset your password and choose...

CVE-2014-5685

The Runtastic Heart Rate aka com.runtastic.android.heartrate.lite application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Runtastic Heart Rate aka com.runtastic.android.heartrate.lite application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5685

The Runtastic Heart Rate aka com.runtastic.android.heartrate.lite application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5685

CVE-2014-5685 concerns the Android app Runtastic Heart Rate (com.runtastic.android.heartrate.lite), version 1.3, which does not verify X.509 certificates from SSL servers. This approval gap allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certific...

PT-2014-6670

Name of the Vulnerable Software and Affected Versions Runtastic Heart Rate application version 1.3 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates from S...

CVE-2014-5685: Undefined Security Weakness

The Runtastic Heart Rate aka com.runtastic.android.heartrate.lite application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

X (Formerly Twitter): Missing Rate Limiting on https://twitter.com/account/complete

The following link is missing rate limiting https://twitter.com/account/complete by which an attacker can get all the valid phone no. on twitters account. POC :- Screenshot attached...

PT-2014-5239

Name of the Vulnerable Software and Affected Versions Cisco 1800 Series Integrated Services Routers ISR version 15.14M2 Description The issue allows remote attackers to cause a denial of service device hang by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision...

CVE-2014-3347: Undefined Security Weakness

Cisco IOS 15.14M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service device hang by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid...