PT-2014-7674

Name of the Vulnerable Software and Affected Versions PinkFong TV version 4 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates from SSL servers...

CVE-2014-6967: Undefined Security Weakness

The Albion College aka com.vivomobile.albioncollege application 2.1.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7657

Name of the Vulnerable Software and Affected Versions com.mitake.TBB version 2.04 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates from SSL servers...

CVE-2014-6965: Undefined Security Weakness

The FAZ.NET aka net.faz.FAZ application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PYSEC-2014-13

Requests aka python-requests before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request...

CVE-2014-1830

Requests aka python-requests before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request...

CVE-2014-6943

The Konigsleiten aka com.knigsleiten application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6948

The TH3 professional Al Mohtarif aka com.th3professional.almohtarif application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6944

The mitfahrgelegenheit.at aka com.carpooling.android.at application 2.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7622

Name of the Vulnerable Software and Affected Versions com.appzone619 The Re:kyu application version 1.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from...

PT-2014-7618

Name of the Vulnerable Software and Affected Versions Alisha Marie Unofficial version 1.4.0.6 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates from SSL...

PT-2014-7624

Name of the Vulnerable Software and Affected Versions com.th3professional.almohtarif version 1.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL...

POODLE SSL 3.0 Attack Exploits Widely-used Web Encryption Standard

Another Heartbleed-like vulnerability has been discovered in the decade old but still widely used Secure Sockets Layer SSL 3.0 cryptographic protocol that could allow an attacker to decrypt contents of encrypted connections to websites. Google's Security Team revealed on Tuesday that the most...

New POODLE SSL 3.0 Attack Exploits Protocol Fallback Issue

A new attack on the SSLv3 protocol, disclosed Tuesday, takes advantage of an issue with the protocol that enables a network attacker to recover the plaintext communications of a victim. The attack is considered easier to exploit than similar previous attacks against SSL/TLS, such as BEAST and...

[SECURITY] Fedora 19 Update: mediawiki-1.23.5-1.fc19

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

libXv: Array Index error leading to heap-based OOB write

Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service crash and possibly execute arbitrary code via crafted length or index values to the XvQueryPortAttributes function...

libXcursor: Integer overflow leading to heap-based buffer overflow

Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XcursorFileHeaderCreate function...

libXrandr: Multiple integer overflows leading to heap-based bufer overflows

Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XRRQueryOutputProperty and 2 XRRQueryProviderProperty functions...

libXi: Multiple integer overflows leading to heap-based buffer-overflows

Multiple integer overflows in X.org libXi 1.7.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XGetDeviceControl, 2 XGetFeedbackControl, 3 XGetDeviceDontPropagateList, 4 XGetDeviceMotionEvents, 5 XIGetProperty, 6...

Amazon Linux AMI : libXfont (ALAS-2014-404)

Multiple integer overflows in the 1 fsgetreply, 2 fsallocglyphs, and 3 fsreadextentinfo functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. Multiple buffer overflows in...