208 matches found
CVE-2014-6133
IBM API Management 3.x before 3.0.1.0 allows local users to obtain sensitive ciphertext information via unspecified vectors...
CVE-2014-6922
The KFAI Community Radio aka com.skyblue.pra.kfai application 2.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Ecava IntegraXor < 4.2.4458 Multiple Vulnerabilities
Binary data 8400.prm...
Information disclosure
The Furdiburb aka com.sheado.lite.pet application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-5247
The UpgradeBeforeConfigurationChange function in lib/client/gntcluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information...
Google Chrome Multiple Vulnerabilities - 01 (Aug 2014) - Mac OS X
Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...
Pearl Forums 2.0 Index.PHP Local File Include Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/15433/info Pearl Forums is prone to a local file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage this issue to disclose sensitive...
Design/Logic Flaw
JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text:...
Target Attackers Took 11 GB of Data, Researchers Say
The attackers who infiltrated Target’s network several weeks ago and made off with 40 million credit and debit card numbers used a multi-stage attack, funneling their stolen data through an FTP server and then a VPS server in Russia. It took more than two weeks, but the attackers eventually...
CVE-2012-0263
monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by 1 a malformed hoststatustypes parameter to status/service/all or 2 a crafted request to...
CVE-2013-2076
Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged t...
CVE-2013-1928
The dovideosetspupalette function in fs/compatioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEOSETSPUPALETTE ioctl call on a /dev/dvb device...
Fedora 17 : openstack-glance-2012.1.2-2.fc17 (2012-18085)
Fix Glance Authentication bypass for image deletion - Update to stable/essex 2012.1.2 including... - Support zero-size image creation via the v1 API - Allow admins to share images regardless of owner - Log sensitive store info, rather than exposing over API - Fix the qpidheartbeat option to avoid...
CVE-2011-2390
The default value of "StrictHostKeyChecking=no" has been used for kdump/ mkdumprd openssh integration. A remote malicious kdump server could use this flaw to impersonate the intended, correct kdump server to obtain security sensitive information kdump core files...
KLINK SQL Injection
Andr�s G�mez Exploit Title : KLINK Sql Injection Vulnerability Date : 2010-12-31 Author : Andr�s G�mez Software Developed by : http://www.contacto.com Contact : [email protected] Dork : "allinurl:.php?txtCodiInfo=" An attacker may execute arbitrary SQL statements on the vulnerable system...
System Shop - 'Module aktka' SQL Injection
/ | / | | | | | | | | | | | | | | | \ | || | | /| | | | | || || | \ | | | | |/||| \| || Exploit Title: System Shop SQL Injection - Module aktkat= Date: 12.09.2010 Author: secret Software Link: www.system-shop.at Version: latest version Tested on: XP / Linux Dorks : inurl:"aktkat" / "Powered by...
CVE-2010-1736
KrM Haber 1.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for database/Krmdb.mdb...
Design/Logic Flaw
Opera 10.50 allows remote attackers to obtain sensitive information via crafted XSLT constructs, which cause Opera to return cached contents of other pages...
Joomla! Component User Status - Local File Inclusion
Joomla! Component User Status - Local File Inclusion --------------------------------------------------------------------------------- Joomla Component User Status Local File Inclusion --------------------------------------------------------------------------------- Author : Chip D3 Bi0s Group :...