CVE-2015-3325: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERYSTRING to the default URI...

WordPress Onclick Show Popup Plugin <= 6.5 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

ipa security, bug fix, and enhancement update

4.1.0-18.0.1 - Replace login-screen-logo.png 20362818 - Drop subscription-manager requires for OL7 - Drop redhat-access-plugin-ipa requires for OL7 - Blank out header-logo.png product-name.png 4.1.0-18 - Fix ipa-pwd-extop global configuration caching 1187342 - group-detach does not add correct...

DEBIAN-CVE-2015-0222

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

PYSEC-2015-7

ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when showhiddeninitial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries...

FTC Urges IoT Privacy, Security at Consumer Electronics Show

In her keynote address yesterday at the Consumer Electronics Show in Las Vegas, Federal Trade Commission Chairwoman Edith Ramirez imagined the dystopic convergence of big data conglomerates and a ceaseless information gathering machine fueled by the constant connectivity ushered in by the so-call...

Apache POI Denial of Service Vulnerability

Apache POI is a free and open source cross-platform Java API written in Java . A denial of service vulnerability in HSLFSlideShow in Apache POI versions prior to 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock by crafting a PPT file...

DEBIAN-CVE-2014-9527

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service infinite loop and deadlock via a crafted PPT file...

ArubaOS 6.3.1.11 / 6.4.2.1 SSH Authentication Bypass

The version of ArubaOS has an unspecified vulnerability that allows a remote attacker to obtain limited administrative privileges without valid credentials. The vulnerability affects access over SSH. However, access through WebUI and the serial port is not affected, and the vulnerability does not...

Information disclosure

The Jamal Bates Show aka com.conduit.app3a95e13827c54c4da9056fafb33ecc8d.app application 1.3.14.254 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6865

The Jamal Bates Show aka com.conduit.app3a95e13827c54c4da9056fafb33ecc8d.app application 1.3.14.254 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6865

The CVE-2014-6865 entry concerns the Android app The Jamal Bates Show (package com.conduit.app_3a95e13827c54c4da9056fafb33ecc8d.app) version 1.3.14.254. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and...

CVE-2014-6865: Undefined Security Weakness

The Jamal Bates Show aka com.conduit.app3a95e13827c54c4da9056fafb33ecc8d.app application 1.3.14.254 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7541

Name of the Vulnerable Software and Affected Versions The Jamal Bates Show aka com.conduit.app 3a95e13827c54c4da9056fafb33ecc8d.app version 1.3.14.254 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obta...

WordPress Theme Marble Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title : WordPress Theme Marble Arbitrary File Download Vulnerability Exploit Author : NULLPointer Date : 17/09/2014 Vendor Homepage : http://themeforest.net/item/marble-flat-responsive-creative-wordpress-theme/5896650 Version: 1.1.2...

WordPress Plugin Wordfence Security - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/69815/info The Wordfence Security Plugin for WordPress is prone to following vulnerabilities: 1. Multiple HTML-Injection vulnerabilities 2. Multiple Security Bypass vulnerabilities Successful exploits of these issues allow the attacker-supplied HTML and...

CVE-2014-5860

The Slide Show Creator aka com.amem application 4.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Slide Show Creator aka com.amem application 4.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5860

The CVE-2014-5860 entry concerns the Android app Slide Show Creator (com.amem) version 4.4.3. The vulnerability arises because the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certifi...

CVE-2014-5860: Undefined Security Weakness

The Slide Show Creator aka com.amem application 4.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...