CVEs

391,069 total · page 6533 of 7,822

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	KEV	Published	Description
CVE-2012-5501	Plone (software) Plone		0.00	—	0.01		Sep 30, 2014	at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
CVE-2012-5499	Plone (software) Plone		0.00	—	0.02		Sep 30, 2014	python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.
CVE-2012-5498	Plone (software) Plone		0.00	—	0.03		Sep 30, 2014	queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.
CVE-2012-5497	Plone (software) Plone		0.00	—	0.02		Sep 30, 2014	membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.
CVE-2012-5496	Plone (software) Plone		0.00	—	0.02		Sep 30, 2014	kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.
CVE-2012-5495	Plone (software) Plone		0.00	—	0.02		Sep 30, 2014	python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."
CVE-2012-5494	Plone (software) Plone		0.00	—	0.01		Sep 30, 2014	Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."
CVE-2012-5493	Plone (software) Plone		0.00	—	0.02		Sep 30, 2014	gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.
CVE-2012-5492	Plone (software) Plone		0.00	—	0.01		Sep 30, 2014	uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.
CVE-2012-5491	Plone (software) Plone		0.00	—	0.01		Sep 30, 2014	z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
CVE-2012-5490	Plone (software) Plone		0.00	—	0.01		Sep 30, 2014	Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-5489	Zope Zope		0.00	—	0.02		Sep 30, 2014	The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
CVE-2012-5488	Plone (software) Plone		0.00	—	0.03		Sep 30, 2014	python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.
CVE-2012-5487	Plone (software) Plone		0.00	—	0.02		Sep 30, 2014	The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.
CVE-2012-5486	Zope Zope		0.00	—	0.03		Sep 30, 2014	ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.
CVE-2012-5485	Plone (software) Plone		0.00	—	0.02		Sep 30, 2014	registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
CVE-2014-6836	Synology Ds Photo\+		0.00	—	0.00		Sep 30, 2014	The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6835	Herbal Guide Herbal Guide		0.00	—	0.00		Sep 30, 2014	The Herbal Guide (aka com.pocket.herbal.guide) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6834	Instaroid Instagram Viewer Project Instaroid Instagram Viewer		0.00	—	0.00		Sep 30, 2014	The Instaroid - Instagram Viewer (aka net.muik.instaroid) application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6833	Auctiontrac Auctiontrac Dealer		0.00	—	0.00		Sep 30, 2014	The AuctionTrac Dealer (aka com.adesa.dealer.phone) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6832	Gcspublishing Bersa Forum		0.00	—	0.00		Sep 30, 2014	The Bersa Forum (aka com.gcspublishing.bersaforum) application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6831	Hippostudio Hippo Studio		0.00	—	0.00		Sep 30, 2014	The Hippo Studio (aka com.appgreen.hippostudio) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6830	Covetfashion Covet Fashion Shopping Game		0.00	—	0.00		Sep 30, 2014	The Covet Fashion - Shopping Game (aka com.crowdstar.covetfashion) application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6829	Gethook Hook		0.00	—	0.00		Sep 30, 2014	The Hook (aka com.hook.android) application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6828	Gulf Credit Union Fi_Mobile.Gulf		0.00	—	0.00		Sep 30, 2014	The Gulf Credit Union (aka Fi_Mobile.Gulf) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6827	Com.sgmobile.dkonline DK ONLINE Beta		0.00	—	0.00		Sep 30, 2014	The DK ONLINE Beta (aka com.sgmobile.dkonline) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6826	Tothemax Tic-Tac To The MAX FREE		0.00	—	0.00		Sep 30, 2014	The Tic-Tac To The MAX FREE (aka com.tothemax) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6825	Teatrofrancoparenti Teatro Franco Parenti		0.00	—	0.00		Sep 30, 2014	The Teatro Franco Parenti (aka com.mintlab.mx.teatroparenti) application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6824	Kamkomesan Project Kamkomesan		0.00	—	0.00		Sep 30, 2014	The kamkomesan (aka com.anek.kamkomesan) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6823	Licai kuailecaidengmi		0.00	—	0.00		Sep 30, 2014	The kuailecaidengmi (aka com.licai.kuailecaidengmi) application 1.7.12.15 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6822	Nerdico Project Nerdico		0.00	—	0.00		Sep 30, 2014	The Nerdico (aka com.nerdico.danielepais) application 1.9 Stable for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6821	Nl.jborsje.android.voetbal.az voetbal		0.00	—	0.00		Sep 30, 2014	The voetbal (aka nl.jborsje.android.voetbal.az) application 4.7.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6820	Amebra Ameba		0.00	—	0.00		Sep 30, 2014	The Amebra Ameba (aka jp.honeytrap15.amebra) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6819	Lappgroup Lapp Group Catalogue		0.00	—	0.00		Sep 30, 2014	The Lapp Group Catalogue (aka com.prinovis.LappKabel) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6818	Core Apps Ohbm 20th Annual Meeting		0.00	—	0.00		Sep 30, 2014	The OHBM 20th Annual Meeting (aka com.coreapps.android.followme.ohbm2014) application 6.0.9.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6817	Cove Cove		0.00	—	0.00		Sep 30, 2014	The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6816	Lvtu99 Wisdom		0.00	—	0.00		Sep 30, 2014	The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6815	Voucherry Vouch\!		0.00	—	0.00		Sep 30, 2014	The Vouch! (aka com.voucherry.voucherry) application 2.1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6814	Sentinels Randomizer Project Sentinels Randomizer		0.00	—	0.00		Sep 30, 2014	The Sentinels Randomizer (aka com.mikehipps.sentinelsrandomizer) application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6813	Klassens Project Klassens		0.00	—	0.00		Sep 30, 2014	The klassens (aka com.mcreda.klassens.apps) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6812	Aloha Guide com.aloha.guide.english		0.00	—	0.00		Sep 30, 2014	The Aloha Guide (aka com.aloha.guide.english) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6810	Core Apps Rims 2014 Annual Conference		0.00	—	0.00		Sep 30, 2014	The RIMS 2014 Annual Conference (aka com.coreapps.android.followme.rims2014) application 6.0.7.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6808	Zentity Active 24		0.00	—	0.00		Sep 30, 2014	The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6807	Conduit OLA School		0.00	—	0.00		Sep 30, 2014	The OLA School (aka com.conduit.app_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6806	Thanodi Thanodi - Setswana Translator		0.00	—	0.00		Sep 30, 2014	The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6805	Weibo Project Weibo		0.00	—	0.00		Sep 30, 2014	The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6278	GNU Bash	Hig	0.80	8.8	1.00	KEV	Sep 30, 2014	GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH…
CVE-2013-3632	Openmediavault Openmediavault	Hig	0.65	8.8	0.57		Sep 29, 2014	The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.
CVE-2013-3092	Belkin N300		0.00	—	0.02		Sep 29, 2014	The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via vectors related to incorrect validation of the HTTP Authorization header.
CVE-2013-3089	Belkin N300		0.00	—	0.01		Sep 29, 2014	Cross-site request forgery (CSRF) vulnerability in apply.cgi in Belkin N300 (F7D7301v1) router allows remote attackers to hijack the authentication of administrators for requests that modify configuration.

CVE-2012-5501Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.01
at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
CVE-2012-5499Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.
CVE-2012-5498Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.03
queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.
CVE-2012-5497Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.
CVE-2012-5496Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.
CVE-2012-5495Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."
CVE-2012-5494Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."
CVE-2012-5493Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.
CVE-2012-5492Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.01
uid_catalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.
CVE-2012-5491Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.01
z3c.form, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
CVE-2012-5490Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in kssdevel.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2012-5489Sep 30, 2014
Zope
Zope
risk 0.00cvss —epss 0.02
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.
CVE-2012-5488Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.03
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.
CVE-2012-5487Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.
CVE-2012-5486Sep 30, 2014
Zope
Zope
risk 0.00cvss —epss 0.03
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.
CVE-2012-5485Sep 30, 2014
Plone (software)
Plone
risk 0.00cvss —epss 0.02
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
CVE-2014-6836Sep 30, 2014
Synology
Ds Photo\+
risk 0.00cvss —epss 0.00
The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6835Sep 30, 2014
Herbal Guide
Herbal Guide
risk 0.00cvss —epss 0.00
The Herbal Guide (aka com.pocket.herbal.guide) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6834Sep 30, 2014
Instaroid Instagram Viewer Project
Instaroid Instagram Viewer
risk 0.00cvss —epss 0.00
The Instaroid - Instagram Viewer (aka net.muik.instaroid) application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6833Sep 30, 2014
Auctiontrac
Auctiontrac Dealer
risk 0.00cvss —epss 0.00
The AuctionTrac Dealer (aka com.adesa.dealer.phone) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6832Sep 30, 2014
Gcspublishing
Bersa Forum
risk 0.00cvss —epss 0.00
The Bersa Forum (aka com.gcspublishing.bersaforum) application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6831Sep 30, 2014
Hippostudio
Hippo Studio
risk 0.00cvss —epss 0.00
The Hippo Studio (aka com.appgreen.hippostudio) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6830Sep 30, 2014
Covetfashion
Covet Fashion Shopping Game
risk 0.00cvss —epss 0.00
The Covet Fashion - Shopping Game (aka com.crowdstar.covetfashion) application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6829Sep 30, 2014
Gethook
Hook
risk 0.00cvss —epss 0.00
The Hook (aka com.hook.android) application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6828Sep 30, 2014
Gulf Credit Union
Fi_Mobile.Gulf
risk 0.00cvss —epss 0.00
The Gulf Credit Union (aka Fi_Mobile.Gulf) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6827Sep 30, 2014
Com.sgmobile.dkonline
DK ONLINE Beta
risk 0.00cvss —epss 0.00
The DK ONLINE Beta (aka com.sgmobile.dkonline) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6826Sep 30, 2014
Tothemax
Tic-Tac To The MAX FREE
risk 0.00cvss —epss 0.00
The Tic-Tac To The MAX FREE (aka com.tothemax) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6825Sep 30, 2014
Teatrofrancoparenti
Teatro Franco Parenti
risk 0.00cvss —epss 0.00
The Teatro Franco Parenti (aka com.mintlab.mx.teatroparenti) application 1.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6824Sep 30, 2014
Kamkomesan Project
Kamkomesan
risk 0.00cvss —epss 0.00
The kamkomesan (aka com.anek.kamkomesan) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6823Sep 30, 2014
Licai
kuailecaidengmi
risk 0.00cvss —epss 0.00
The kuailecaidengmi (aka com.licai.kuailecaidengmi) application 1.7.12.15 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6822Sep 30, 2014
Nerdico Project
Nerdico
risk 0.00cvss —epss 0.00
The Nerdico (aka com.nerdico.danielepais) application 1.9 Stable for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6821Sep 30, 2014
Nl.jborsje.android.voetbal.az
voetbal
risk 0.00cvss —epss 0.00
The voetbal (aka nl.jborsje.android.voetbal.az) application 4.7.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6820Sep 30, 2014
Amebra
Ameba
risk 0.00cvss —epss 0.00
The Amebra Ameba (aka jp.honeytrap15.amebra) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6819Sep 30, 2014
Lappgroup
Lapp Group Catalogue
risk 0.00cvss —epss 0.00
The Lapp Group Catalogue (aka com.prinovis.LappKabel) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6818Sep 30, 2014
Core Apps
Ohbm 20th Annual Meeting
risk 0.00cvss —epss 0.00
The OHBM 20th Annual Meeting (aka com.coreapps.android.followme.ohbm2014) application 6.0.9.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6817Sep 30, 2014
Cove
Cove
risk 0.00cvss —epss 0.00
The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6816Sep 30, 2014
Lvtu99
Wisdom
risk 0.00cvss —epss 0.00
The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6815Sep 30, 2014
Voucherry
Vouch\!
risk 0.00cvss —epss 0.00
The Vouch! (aka com.voucherry.voucherry) application 2.1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6814Sep 30, 2014
Sentinels Randomizer Project
Sentinels Randomizer
risk 0.00cvss —epss 0.00
The Sentinels Randomizer (aka com.mikehipps.sentinelsrandomizer) application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6813Sep 30, 2014
Klassens Project
Klassens
risk 0.00cvss —epss 0.00
The klassens (aka com.mcreda.klassens.apps) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6812Sep 30, 2014
Aloha Guide
com.aloha.guide.english
risk 0.00cvss —epss 0.00
The Aloha Guide (aka com.aloha.guide.english) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6810Sep 30, 2014
Core Apps
Rims 2014 Annual Conference
risk 0.00cvss —epss 0.00
The RIMS 2014 Annual Conference (aka com.coreapps.android.followme.rims2014) application 6.0.7.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6808Sep 30, 2014
Zentity
Active 24
risk 0.00cvss —epss 0.00
The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6807Sep 30, 2014
Conduit
OLA School
risk 0.00cvss —epss 0.00
The OLA School (aka com.conduit.app_00f9890a4f0145f2aae9d714e20b273a.app) application 1.2.7.132 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6806Sep 30, 2014
Thanodi
Thanodi - Setswana Translator
risk 0.00cvss —epss 0.00
The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6805Sep 30, 2014
Weibo Project
Weibo
risk 0.00cvss —epss 0.00
The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-6278HigKEVSep 30, 2014
GNU
Bash
risk 0.80cvss 8.8epss 1.00
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH…
CVE-2013-3632HigSep 29, 2014
Openmediavault
Openmediavault
risk 0.65cvss 8.8epss 0.57
The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.
CVE-2013-3092Sep 29, 2014
Belkin
N300
risk 0.00cvss —epss 0.02
The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via vectors related to incorrect validation of the HTTP Authorization header.
CVE-2013-3089Sep 29, 2014
Belkin
N300
risk 0.00cvss —epss 0.01
Cross-site request forgery (CSRF) vulnerability in apply.cgi in Belkin N300 (F7D7301v1) router allows remote attackers to hijack the authentication of administrators for requests that modify configuration.