CVE-2014-7689

The GzoneRC - The RC Hobby Hub aka com.wGzoneRC application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7689

The CVE-2014-7689 entry corresponds to the Android app “The GzoneRC - The RC Hobby Hub (com.wGzoneRC)” version 0.1, where the app does not verify X.509 certificates when connecting to SSL servers. This behavior can allow a man‑in‑the‑middle attacker to spoof servers and access sensitive informati...

CVE-2014-7054

Summary of CVE-2014-7054 : The Android app musica de barrios sonideros (package com.nobexinc.wls_93155702.rc), version 3.3.10, does not verify X.509 certificates when connecting to SSL servers. This allows a man‑in‑the‑middle attacker to spoof servers and obtain sensitive information via a crafte...

CVE-2014-6901

The CVE-2014-6901 entry concerns the Android app RADIOS DEL ECUADOR (package com.nobexinc.wls_87612622.rc), version 3.2.4. The root cause is that the application does not verify X.509 certificates from SSL servers, which can permit man-in-the-middle attackers to spoof servers and access sensitive...

Information disclosure

The RE-VOLT 2 : Best RC 3D Racing aka com.wego.revolt2global application 1.2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5743

The RE-VOLT 2 : Best RC 3D Racing aka com.wego.revolt2global application 1.2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5743

CVE-2014-5743 affects the Android app RE-VOLT 2: Best RC 3D Racing (com.wego.revolt2_global) version 1.2.6. The root cause is that the app does not verify X.509 certificates from SSL servers, enabling a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certificate....

Xine-Lib 0.99 Remote Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10890/info It is reported that the xine media library is affected by a remote buffer overflow vulnerability. This issue can allow a remote attacker to gain unauthorized access to a vulnerable computer. xine-lib rc-5 and...

KDE 1.1.2 KApplication configfile vulnerability (3)

No description provided by source. source: http://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can modify ownership of arbitrary fil...

Exhibit Engine <= 1.5 RC 4 (photo_comment.php) File Include Exploit

No description provided by source. ' ' EXPLOIT coded by Kacper in Visual Basic ;- ' '::::::::: :::::::::: ::: ::: ::::::::::: ::: ':+: :+: :+: :+: :+: :+: :+: '+:+ +:+ +:+ +:+ +:+ +:+ +:+ '++ +:+ +++:++ ++ +:+ ++ ++ '++ ++ ++ ++ ++ ++ ++ '+ + + +++ + + ' '::::::::::: :::::::::: ::: :::: :::: ' :+...

EasyWeb 1.0 FileManager Module Directory Traversal Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10792/info EasyWeb is prone to a directory traversal vulnerability. This issue presents itself due to insufficient sanitization of user-supplied data. The issue occurs if a remote attacker sends a request to the...

openSUSE Security Update : apache2 (openSUSE-SU-2012:0212-1)

This update fixes several security issues in the Apache2 webserver. CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a modproxy reverse exposure via RewriteRule or ProxyPassMatch directives. CVE-2011-3607: Integer overflow in appregsub function resulting in a heap based...

Code injection

The 1 dosend and 2 dorecv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."...

CVE-2014-1896

The 1 dosend and 2 dorecv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."...

CVE-2009-5141

War FTP Daemon (warftpd) 1.82 RC 12 has a format string vulnerability in the LIST command that lets remote authenticated users crash the service (denial of service). Root cause is improper handling of format specifiers in the LIST response. The issue is documented across Red Hat, NVD/NIST, and CV...

DEBIAN-CVE-2013-2142

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDGCONFIGHOME are not set, allows local users to overwrite arbitrary files via a symlink attack on 1 HostCertificate.pem, 2 HostPrivateKey.pem, 3 libimobiledevicerc, 4 RootCertificate.pem, or 5 RootPrivateKey.pem in...

CVE-2013-4952

Elemata CMS RC 3.0 is affected by CVE-2013-4952: a SQL injection in functions/global.php allowing remote attackers to execute arbitrary SQL via the id parameter. The issue is network-exploitable with no authentication (CVSSv2: AV:N/AC:L/Au:N/C:P/I:P/A:P; base score 7.5). Impact is partial confide...

DEBIAN-CVE-2012-5635

The GlusterFS functionality in Red Hat Storage Management Console 2.0, Native Client, and Server 2.0 allows local users to overwrite arbitrary files via a symlink attack on multiple temporary files created by 1 tests/volume.rc, 2 extras/hook-scripts/S30samba-stop.sh, and possibly other vectors,...

CVE-2013-2566

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext...

OrangeHRM - 'sortField' SQL Injection

source: https://www.securityfocus.com/bid/56417/info OrangeHRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify dat...