Cross site scripting

Google Chrome before 41.0.2272.76, when Instant Extended mode is used, does not properly consider the interaction between the "1993 search" features and restore-from-disk RELOAD transitions, which makes it easier for remote attackers to spoof the address bar for a search-results page by leveragin...

Code injection

The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream...

CVE-2015-1595

The Siemens SPCanywhere application for Android and iOS does not use encryption during lookups of system ID to IP address mappings, which allows man-in-the-middle attackers to discover alarm IP addresses and spoof servers by intercepting the client-server data stream...

PT-2015-5376

Name of the Vulnerable Software and Affected Versions Siemens SPCanywhere affected versions not specified Description The issue concerns the lack of encryption during lookups of system ID to IP address mappings in the Siemens SPCanywhere application. This allows man-in-the-middle attackers to...

Design/Logic Flaw

The SDK for Komodia Redirector with SSL Digestor, as used in Lavasoft Ad-Aware Web Companion 1.1.885.1766 and Ad-Aware AdBlocker alpha 1.3.69.1, Qustodio for Windows, Atom Security, Inc. StaffCop 5.8, and other products, does not properly verify X.509 certificates from SSL servers, which allows...

SuSE 11.3 Security Update : ntp (SAT Patch Number 10293)

ntp has been updated to fix four security issues : - ntp-keygen used a weak RNG seed, which made it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack. bsc910764. CVE-2014-9294 - The configauth function, when an auth key is not configured, improperl...

PT-2015-4124

Name of the Vulnerable Software and Affected Versions IBM Security AppScan Standard versions 8.x through 9.x before 9.0.1.1 FP1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted X.509 certificate, as the software does not...

CVE-2014-8918: Undefined Security Weakness

IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Debian: Security Advisory (DSA-3151-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-9194

Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service disruption via crafted radio transmissions that spoof GPS satellite broadcasts...

CVE-2015-0219

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an underscore character instead of a - dash character in an HTTP header, as demonstrated by an X-AuthUser header...

CVE-2014-8151

The darwinsslconnectstep1 function in lib/vtls/curldarwinssl.c in libcurl 7.31.0 through 7.39.0, when using the DarwinSSL aka SecureTransport back-end for TLS, does not check if a cached TLS session validated the certificate when reusing the session, which allows man-in-the-middle attackers to...

Design/Logic Flaw

The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web si...

CVE-2014-7193

The Crumb plugin before 3.0.0 for Node.js does not properly restrict token access in situations where a hapi route handler has CORS enabled, which allows remote attackers to obtain sensitive information, and potentially obtain the ability to spoof requests to non-CORS routes, via a crafted web si...

PT-2014-7828

Name of the Vulnerable Software and Affected Versions Crumb plugin versions prior to 3.0.0 Description The issue allows remote attackers to obtain sensitive information and potentially spoof requests to non-CORS routes by exploiting improper token access restriction in situations where a hapi rou...

DEBIAN-CVE-2014-9378

Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service crash or possibly execute arbitrary code via a crafted 1 name to the parseline function in mdnsspoof/mdnsspoof.c or 2 base64 encoded password to the dissectorimap function in...

DEBIAN-CVE-2014-9377

Heap-based buffer overflow in the nbnsspoof function in plug-ins/nbnsspoof/nbnsspoof.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large netbios packet...

CVE-2014-9135

The PackageInstaller module in Huawei P7-L10 smartphones before V100R001C00B136 allows remote attackers to spoof the origin website and bypass the website whitelist protection mechanism via a crafted package...

PT-2014-8972

Name of the Vulnerable Software and Affected Versions Ettercap version 0.8.1 Description A heap-based buffer overflow issue exists in the nbns spoof function, located in plug-ins/nbns spoof/nbns spoof.c. This allows remote attackers to potentially cause a denial of service or execute arbitrary co...

PT-2014-8842

Name of the Vulnerable Software and Affected Versions Huawei P7-L10 smartphones versions prior to V100R001C00B136 Description The issue concerns the PackageInstaller module, which can be exploited by remote attackers to spoof the origin website. This allows bypassing the website whitelist...