CVEs

355,873 total · page 5839 of 7,118

CVE	Vendor / Product	Risk	CVSS	EPSS	Published	Description
CVE-2014-4352	Apple Inc. iOS	0.00	—	0.00	Sep 18, 2014	Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
CVE-2014-2886	GKSu GKSu	0.00	—	0.02	Sep 18, 2014	GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename…
CVE-2012-6658	Spiceworks Spiceworks	0.03	—	0.02	Sep 17, 2014	Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName configuration in snmpd.conf. NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2…
CVE-2012-2956	Spiceworks Spiceworks	0.03	—	0.01	Sep 17, 2014	SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS.
CVE-2014-5235	Open-Xchange Appsuite	0.00	—	0.02	Sep 17, 2014	Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds.
CVE-2014-5234	Open-Xchange Appsuite	0.00	—	0.02	Sep 17, 2014	Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name.
CVE-2012-2583	WordPress Mini Mail Dashboard Widget	0.03	—	0.04	Sep 17, 2014	Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.
CVE-2012-1507	Orangehrm Orangehrm	0.03	—	0.02	Sep 17, 2014	Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3)…
CVE-2012-1506	Orangehrm Orangehrm	0.03	—	0.01	Sep 17, 2014	SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details…
CVE-2012-1417	Yealink Gigabit Color IP Phone Sip T32g	0.03	—	0.02	Sep 17, 2014	Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.
CVE-2012-1032	Siteseeker Euroling Siteseeker	0.00	—	0.01	Sep 17, 2014	Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely…
CVE-2014-5918	Secretcircle Secret Circle Talk Freely	0.00	—	0.00	Sep 17, 2014	The Secret Circle - talk freely (aka com.easyxapp.secret) application 2.2.00.26 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5917	Grassapper Slideshow 365	0.00	—	0.00	Sep 17, 2014	The Slideshow 365 (aka com.Slideshow) application 3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5916	Oi Minha Oi	0.00	—	0.00	Sep 17, 2014	The Minha Oi (aka br.com.mobicare.minhaoi) application 1.15.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5915	Tigo Tigo Copa Mundial Fifa 2014	0.00	—	0.00	Sep 17, 2014	The Tigo Copa Mundial FIFA 2014 (aka com.fwc2014.millicom.and) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5914	Finansbank Cep Subesi	0.00	—	0.00	Sep 17, 2014	The Finansbank Cep Subesi (aka com.finansbank.mobile.cepsube) application 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5913	Game Lion Allies In War	0.00	—	0.00	Sep 17, 2014	The Allies in War (aka com.gamelion.aiw) application 1.3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5912	Intsig Innote	0.00	—	0.00	Sep 17, 2014	The InNote (aka com.intsig.notes) application 1.0.3.20131119 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5911	Jellytap Free App Icons \& Icon Packs	0.00	—	0.00	Sep 17, 2014	The Free App Icons & Icon Packs (aka com.jellytap.cooliconfinder) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5910	Dog Whistle Project Dog Whistle	0.00	—	0.00	Sep 17, 2014	The Dog Whistle (aka com.dogwhistle.dogtrainingandroidapp) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5909	Watcha Watcha	0.00	—	0.00	Sep 17, 2014	The watcha (aka com.frograms.watcha) application 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5908	Kmart Kmart	0.00	—	0.00	Sep 17, 2014	The Kmart (aka com.kmart.android) application @7F0C00EF for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5907	Libiitech Pet Salon	0.00	—	0.00	Sep 17, 2014	The Pet Salon (aka com.libiitech.petsalon) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5906	Youngmoney Lil Wayne Slots\	0.00	—	0.00	Sep 17, 2014	The Lil Wayne Slots: FREE SLOTS (aka com.lilwayneslots.slots.android) application 1.138 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-4622	EMC Corporation Documentum Content Server	0.00	—	0.03	Sep 17, 2014	EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass intended restrictions on data…
CVE-2014-4621	EMC Corporation Documentum Content Server	0.00	—	0.03	Sep 17, 2014	EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subtypes of protected system types, which allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass…
CVE-2014-0568	Adobe Inc. Acrobat	0.00	—	0.04	Sep 17, 2014	The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction…
CVE-2014-0567	Adobe Inc. Acrobat	0.01	—	0.10	Sep 17, 2014	Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0561.
CVE-2014-0566	Adobe Inc. Acrobat	0.01	—	0.06	Sep 17, 2014	Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0565.
CVE-2014-0565	Adobe Inc. Acrobat	0.00	—	0.05	Sep 17, 2014	Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.
CVE-2014-0563	Adobe Inc. Acrobat	0.00	—	0.03	Sep 17, 2014	Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVE-2014-0562	Adobe Inc. Acrobat	0.00	—	0.02	Sep 17, 2014	Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
CVE-2014-0561	Adobe Inc. Acrobat	0.01	—	0.10	Sep 17, 2014	Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0567.
CVE-2014-0560	Adobe Inc. Acrobat	0.01	—	0.07	Sep 17, 2014	Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVE-2014-6392	Facebook Facebook	0.00	—	0.01	Sep 15, 2014	Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE:…
CVE-2014-5905	Meucarrinho Grocery List Tomatoes	0.00	—	0.00	Sep 15, 2014	The Grocery List - Tomatoes (aka com.meucarrinho) application 5.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5904	Miniinthebox Miniinthebox Online Shopping	0.00	—	0.00	Sep 15, 2014	The MiniInTheBox Online Shopping (aka com.miniinthebox.android) application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5903	Mobileiron Mobile\@work	0.00	—	0.00	Sep 15, 2014	The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5902	Uacinemas Ua Cinemas Mobile Ticketing	0.00	—	0.00	Sep 15, 2014	The UA Cinemas - Mobile ticketing (aka com.mtel.uacinemaapps) application 2.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5901	Webelinx Beauty Bible App For Girls	0.00	—	0.00	Sep 15, 2014	The Beauty Bible - App for Girls (aka com.my.beauty.bible) application 5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5900	Myhomeworkapp Myhomework Student Planner	0.00	—	0.00	Sep 15, 2014	The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5899	Nespresso Nespresso	0.00	—	0.00	Sep 15, 2014	The Nespresso (aka com.nespresso.activities) application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5898	Heavy Duty Truck Driver Simulator 3d Project Heavy Duty Truck Driver Simulator 3d	0.00	—	0.00	Sep 15, 2014	The Heavy Duty Truck Driver Simulator 3D (aka com.oas.heavy.duty.truck.driver.simulator3d) application 1.0.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted…
CVE-2014-5897	Parallelmafia Parallel Mafia Mmorpg	0.00	—	0.00	Sep 15, 2014	The Parallel Mafia MMORPG (aka com.perblue.pm.client) application @7F070000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5896	Seawolftech Globaltalk Free Phone Calls	0.00	—	0.00	Sep 15, 2014	The GlobalTalk- free phone calls (aka com.seawolftech.globaltalk) application 2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5895	Shopyourway Shopyourway	0.00	—	0.00	Sep 15, 2014	The ShopYourWay (aka com.sears.shopyourway) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5894	Pingshow Airetalk Text Call \& More\!	0.00	—	0.00	Sep 15, 2014	The AireTalk: Text, Call, & More! (aka com.pingshow.amper) application 2.0.73 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5893	Shinsegaemall Froyo	0.00	—	0.00	Sep 15, 2014	The froyo (aka com.shinsegae.mobile.froyo) application 5.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5892	Olleh Greenbill	0.00	—	0.00	Sep 15, 2014	The greenbill (aka com.show.greenbill_G) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5891	Snipsnap Snipsnap Coupon App	0.00	—	0.00	Sep 15, 2014	The SnipSnap Coupon App (aka com.snipsnap.snipsnapapp) application 1.1.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2014-4352Sep 18, 2014
Apple Inc.
iOS
risk 0.00cvss —epss 0.00
Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information by obtaining this UID.
CVE-2014-2886Sep 18, 2014
GKSu
GKSu
risk 0.00cvss —epss 0.02
GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows attackers to execute arbitrary commands in certain situations involving an untrusted substring within this argument, as demonstrated by an untrusted filename…
CVE-2012-6658Sep 17, 2014
Spiceworks
Spiceworks
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary web script or HTML via the (1) syslocation, (2) syscontact, or (3) sysName configuration in snmpd.conf. NOTE: this entry was SPLIT from CVE-2012-2956 per ADT2…
CVE-2012-2956Sep 17, 2014
Spiceworks
Spiceworks
risk 0.03cvss —epss 0.01
SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS.
CVE-2014-5235Sep 17, 2014
Open-Xchange
Appsuite
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via vectors related to unspecified fields in RSS feeds.
CVE-2014-5234Sep 17, 2014
Open-Xchange
Appsuite
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x before 7.6.0-rev16 allows remote attackers to inject arbitrary web script or HTML via a folder publication name.
CVE-2012-2583Sep 17, 2014
WordPress
Mini Mail Dashboard Widget
risk 0.03cvss —epss 0.04
Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers to inject arbitrary web script or HTML via the body of an email.
CVE-2012-1507Sep 17, 2014
Orangehrm
Orangehrm
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3)…
CVE-2012-1506Sep 17, 2014
Orangehrm
Orangehrm
risk 0.03cvss —epss 0.01
SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details…
CVE-2012-1417Sep 17, 2014
Yealink
Gigabit Color IP Phone Sip T32g
risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com.
CVE-2012-1032Sep 17, 2014
Siteseeker
Euroling Siteseeker
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely…
CVE-2014-5918Sep 17, 2014
Secretcircle
Secret Circle Talk Freely
risk 0.00cvss —epss 0.00
The Secret Circle - talk freely (aka com.easyxapp.secret) application 2.2.00.26 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5917Sep 17, 2014
Grassapper
Slideshow 365
risk 0.00cvss —epss 0.00
The Slideshow 365 (aka com.Slideshow) application 3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5916Sep 17, 2014
Oi
Minha Oi
risk 0.00cvss —epss 0.00
The Minha Oi (aka br.com.mobicare.minhaoi) application 1.15.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5915Sep 17, 2014
Tigo
Tigo Copa Mundial Fifa 2014
risk 0.00cvss —epss 0.00
The Tigo Copa Mundial FIFA 2014 (aka com.fwc2014.millicom.and) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5914Sep 17, 2014
Finansbank
Cep Subesi
risk 0.00cvss —epss 0.00
The Finansbank Cep Subesi (aka com.finansbank.mobile.cepsube) application 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5913Sep 17, 2014
Game Lion
Allies In War
risk 0.00cvss —epss 0.00
The Allies in War (aka com.gamelion.aiw) application 1.3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5912Sep 17, 2014
Intsig
Innote
risk 0.00cvss —epss 0.00
The InNote (aka com.intsig.notes) application 1.0.3.20131119 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5911Sep 17, 2014
Jellytap
Free App Icons \& Icon Packs
risk 0.00cvss —epss 0.00
The Free App Icons & Icon Packs (aka com.jellytap.cooliconfinder) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5910Sep 17, 2014
Dog Whistle Project
Dog Whistle
risk 0.00cvss —epss 0.00
The Dog Whistle (aka com.dogwhistle.dogtrainingandroidapp) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5909Sep 17, 2014
Watcha
Watcha
risk 0.00cvss —epss 0.00
The watcha (aka com.frograms.watcha) application 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5908Sep 17, 2014
Kmart
Kmart
risk 0.00cvss —epss 0.00
The Kmart (aka com.kmart.android) application @7F0C00EF for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5907Sep 17, 2014
Libiitech
Pet Salon
risk 0.00cvss —epss 0.00
The Pet Salon (aka com.libiitech.petsalon) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5906Sep 17, 2014
Youngmoney
Lil Wayne Slots\
risk 0.00cvss —epss 0.00
The Lil Wayne Slots: FREE SLOTS (aka com.lilwayneslots.slots.android) application 1.138 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-4622Sep 17, 2014
EMC Corporation
Documentum Content Server
risk 0.00cvss —epss 0.03
EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subgroups of privileged groups, which allows remote authenticated sysadmins to gain super-user privileges, and bypass intended restrictions on data…
CVE-2014-4621Sep 17, 2014
EMC Corporation
Documentum Content Server
risk 0.00cvss —epss 0.03
EMC Documentum Content Server before 6.7 SP2 P17, 7.0 through P15, and 7.1 before P08 does not properly check authorization for subtypes of protected system types, which allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass…
CVE-2014-0568Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.00cvss —epss 0.04
The NtSetInformationFile system call hook feature in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows allows attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via an NTFS junction…
CVE-2014-0567Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.01cvss —epss 0.10
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0561.
CVE-2014-0566Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.01cvss —epss 0.06
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0565.
CVE-2014-0565Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.00cvss —epss 0.05
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2014-0566.
CVE-2014-0563Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.00cvss —epss 0.03
Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allow attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVE-2014-0562Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."
CVE-2014-0561Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.01cvss —epss 0.10
Heap-based buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-0567.
CVE-2014-0560Sep 17, 2014
Adobe Inc.
Acrobat
risk 0.01cvss —epss 0.07
Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.12 and 11.x before 11.0.09 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.
CVE-2014-6392Sep 15, 2014
Facebook
Facebook
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE:…
CVE-2014-5905Sep 15, 2014
Meucarrinho
Grocery List Tomatoes
risk 0.00cvss —epss 0.00
The Grocery List - Tomatoes (aka com.meucarrinho) application 5.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5904Sep 15, 2014
Miniinthebox
Miniinthebox Online Shopping
risk 0.00cvss —epss 0.00
The MiniInTheBox Online Shopping (aka com.miniinthebox.android) application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5903Sep 15, 2014
Mobileiron
Mobile\@work
risk 0.00cvss —epss 0.00
The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5902Sep 15, 2014
Uacinemas
Ua Cinemas Mobile Ticketing
risk 0.00cvss —epss 0.00
The UA Cinemas - Mobile ticketing (aka com.mtel.uacinemaapps) application 2.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5901Sep 15, 2014
Webelinx
Beauty Bible App For Girls
risk 0.00cvss —epss 0.00
The Beauty Bible - App for Girls (aka com.my.beauty.bible) application 5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5900Sep 15, 2014
Myhomeworkapp
Myhomework Student Planner
risk 0.00cvss —epss 0.00
The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5899Sep 15, 2014
Nespresso
Nespresso
risk 0.00cvss —epss 0.00
The Nespresso (aka com.nespresso.activities) application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5898Sep 15, 2014
Heavy Duty Truck Driver Simulator 3d Project
Heavy Duty Truck Driver Simulator 3d
risk 0.00cvss —epss 0.00
The Heavy Duty Truck Driver Simulator 3D (aka com.oas.heavy.duty.truck.driver.simulator3d) application 1.0.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted…
CVE-2014-5897Sep 15, 2014
Parallelmafia
Parallel Mafia Mmorpg
risk 0.00cvss —epss 0.00
The Parallel Mafia MMORPG (aka com.perblue.pm.client) application @7F070000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5896Sep 15, 2014
Seawolftech
Globaltalk Free Phone Calls
risk 0.00cvss —epss 0.00
The GlobalTalk- free phone calls (aka com.seawolftech.globaltalk) application 2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5895Sep 15, 2014
Shopyourway
Shopyourway
risk 0.00cvss —epss 0.00
The ShopYourWay (aka com.sears.shopyourway) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5894Sep 15, 2014
Pingshow
Airetalk Text Call \& More\!
risk 0.00cvss —epss 0.00
The AireTalk: Text, Call, & More! (aka com.pingshow.amper) application 2.0.73 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5893Sep 15, 2014
Shinsegaemall
Froyo
risk 0.00cvss —epss 0.00
The froyo (aka com.shinsegae.mobile.froyo) application 5.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5892Sep 15, 2014
Olleh
Greenbill
risk 0.00cvss —epss 0.00
The greenbill (aka com.show.greenbill_G) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-5891Sep 15, 2014
Snipsnap
Snipsnap Coupon App
risk 0.00cvss —epss 0.00
The SnipSnap Coupon App (aka com.snipsnap.snipsnapapp) application 1.1.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.