Information disclosure

The Vodafone Mobile@Work aka com.mobileiron.vodafone.MIClient application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5932

The Vodafone Mobile@Work aka com.mobileiron.vodafone.MIClient application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5932

CVE-2014-5932 affects the Vodafone Mobile@Work (com.mobileiron.vodafone.MIClient) Android app (version 6.0.0.1.12R). The root issue is that the client does not verify X.509 certificates from SSL servers, which permits man-in-the-middle attackers to spoof servers and obtain sensitive information v...

CVE-2014-5903

The Mobile@Work aka com.mobileiron application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Mobile@Work aka com.mobileiron application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5903

The Mobile@Work aka com.mobileiron application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5903

The CVE-2014-5903 entry describes a vulnerability in the Mobile@Work (com.mobileiron) Android app version 6.0.0.1.12R where the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and disclose sensitive information via a crafted certifica...

BSCW 3.4/4.0 Insecure Default Installation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3777/info BSCW Basic Support for Cooperative Work is a web-based groupware application, allowing users to share a workspace via a web interface. It runs on Microsoft Windows NT/2000 systems, as well as a number of Unix...

Work System ECommerce 3.0.3/3.0.4 Forum.PHP Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/21580/info WORK system e-commerce is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue may allow an attacker to compromise the application and...

WORK System E-Commerce <= 3.0.1 - Remote Include Vulnerability

No description provided by source. ============================================================================================ WORK System E-Commerce ginclude Remote File Inclusion Vulnerability ============================================================================================...

work system e-commerce <= 3.0.5 - Remote File Inclusion Vulnerability

No description provided by source. Rodrigo Duarte WuefezAT2die4.com ;D WORK system e-commerce: WORK PHP,Mysql content management system CMS e-commerce or not : ajax, workflow, content,package,language,currency,country,price,stock,group user,CSS,banner,logo,...

Stable Channel Update

The Chrome Team is excited to announce the promotion of Chrome 35 to the Stable channel for Windows, Mac, and Linux. Chrome 35.0.1916.114 contains a number of fixes and improvements, including: More developer control over touch input New JavaScript features Unprefixed Shadow DOM A number of new...

BlackBerry Updates Products Affected by Heartbleed

BlackBerry issued an advisory today that updates are available for all of its products affected by the Heartbleed OpenSSL vulnerability. The mobile device maker said that it is not aware of any exploits targeting BlackBerry products. BlackBerry Messenger BBM for Android and iPhone, as well as...

WordPress Work-The-Flow 1.2.1 Shell Upload

Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload panel and intercept the POST request to...

Wordpress Work-The-Flow Plugin 1.2.1 - Arbitrary File Upload

Exploit for php platform in category web applications Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload...

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf...

WordPress Work The Flow Plugin 1.2.1 - Arbitrary File Upload

Work The Flow plugin is prone to an arbitrary file upload vulnerability that submit an image file via the wtf upload panel and intercept the POST request to /wp-admin/admin-ajax.php. Solution Edit the data from the control "acceptfiletypes"...

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload

Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload panel and intercept the POST request to...

KLA10067 DoS vulnerabilities in Apache httpd

Multiple serious vulnerabilities have been found in Apache httpd. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities 1. Vectors related to modlogconfig can be exploited remotely via a specially designed cookie; 2. An improper...

Synology DSM 4.3-3827 - article.php Blind SQL Injection

Synology DSM 4.3-3827 - article.php Blind SQL Injection Title: Synology DSM Blind SQL Injection Version affected: :80/ Cookie: PHPSESSID=; visitday= Host: Connection: Keep-alive Accept-Encoding: gzip,deflate User-Agent: Mozilla/5.0 Windows NT 6.1; WOW64 AppleWebKit/537.36 KHTML, like Gecko...