Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
19,591 results · page 206 of 392
May 15, 2017The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which alloCVE-2017-8936 · Other software · Changyou · reported by MITREMedium 5.9
The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Dolphin Web Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers toCVE-2017-8935 · Other software · Gocivix · reported by MITREMedium 5.9
The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Indiana Voters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2017The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which alCVE-2017-8923 · Websites & servers · PHP · reported by MITRECritical 9.8
The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
- Product
- PHP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.combugs.php.net
May 12, 2017Microsoft SharePoint Foundation 2013 SP1 allows an elevation of privilege vulnerability when it does not properly sanitize a specially crafted web request, aka CVE-2017-0255 · Email & office · Microsoft Corporation · reported by secure@microsoft.comMedium 5.4
Microsoft SharePoint Foundation 2013 SP1 allows an elevation of privilege vulnerability when it does not properly sanitize a specially crafted web request, aka "Microsoft SharePoint XSS Vulnerability".
- Product
- Microsoft Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comportal.msrc.microsoft.com
May 10, 2017Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.CVE-2017-8891 · Other software · Dropbox · reported by MITREMedium 5.5
Dropbox Lepton 1.2.1 allows DoS (SEGV and application crash) via a malformed lepton file because the code does not ensure setup of a correct number of threads.
- Product
- Lepton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
May 9, 2017wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key.CVE-2017-8855 · Other software · Wolfssl · reported by MITREHigh 7.5
wolfSSL before 3.11.0 does not prevent wc_DhAgree from accepting a malformed DH key.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers andCVE-2017-5919 · Other software · 21st Century Insurance · reported by MITREMedium 5.9
The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- 21st Century Insurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serversCVE-2017-5918 · Other software · Banco DE Costa Rica · reported by MITREMedium 5.9
The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- BCR Movil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-midCVE-2017-5916 · Other software · America's First Federal Credit Union · reported by MITREMedium 5.9
The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- America's First FCU Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSLCVE-2017-5915 · Other software · Emirates NBD Bank P.j.s.c · reported by MITREMedium 5.9
The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Emirates NBD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtCVE-2017-5914 · Other software · Dotit-corp · reported by MITREMedium 5.9
The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Banque Zitouna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers CVE-2017-5913 · Other software · Forex · reported by MITREMedium 5.9
The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Tradeking Forex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2017-5912 · Other software · Forex · reported by MITREMedium 5.9
The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Forextrader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackeCVE-2017-5911 · Other software · Banco Santander Mexico SA · reported by MITREMedium 5.9
The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Supermovil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2017-5909 · Other software · Electronic Funds Source LLC · reported by MITREMedium 5.9
The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- EFS Mobile Driver Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middCVE-2017-5907 · Other software · Great Southern Bank · reported by MITREMedium 5.9
The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Great Southern Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-tCVE-2017-5906 · Other software · Everyday Health INC · reported by MITREMedium 5.9
The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Diabetes IN Check\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtaCVE-2017-5905 · Other software · Dollar Bank · reported by MITREMedium 5.9
The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Dollar Bank Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiCVE-2017-5902 · Other software · Payquicker · reported by MITREMedium 5.9
The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Mypayquicker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sCVE-2017-5901 · Other software · State Bank Of India · reported by MITREMedium 5.9
The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- State Bank Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof seCVE-2017-3213 · Other software · Think Mutual Bank · reported by cret@cert.orgMedium 5.9
The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Think Mutual Bank Mobile Banking App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
May 5, 2017The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middCVE-2017-3212 · Other software · Sccu · reported by cret@cert.orgMedium 5.9
The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Space Coast Credit Union
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
May 2, 2017RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.CVE-2017-8418 · Other software · Rubocop Project · reported by MITRELow 3.3
RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other users.
- Product
- Rubocop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
May 1, 2017Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.CVE-2017-8385 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not prevent modification of the URL in a forgot-password email message.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
May 1, 2017Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.CVE-2017-8383 · Other software · Craftcms · reported by MITREMedium 5.3
Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the craft/app/ folder.
- Product
- Craft CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcraftcms.comtwitter.com
Apr 28, 2017The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atCVE-2017-2110 · Other software · NISSAN SECURITIES CO., LTD. · reported by vultures@jpcert.or.jpMedium 5.9
The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Access CX App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obCVE-2017-2105 · Other software · PRESENTCAST INC. · reported by vultures@jpcert.or.jpMedium 5.9
The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- TVer App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof CVE-2017-2104 · Other software · K-Opticom Corporation · reported by vultures@jpcert.or.jpMedium 5.9
The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Business LaLa Call App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers aCVE-2017-2103 · Other software · K-Opticom Corporation · reported by vultures@jpcert.or.jpMedium 5.9
The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- LaLa Call App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 26, 2017IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.CVE-2016-8962 · Other software · IBM Corporation · reported by psirt@us.ibm.comMedium 5.9
IBM BigFix Inventory 9.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 118851.
- Product
- BigFix Inventory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordibm.comsecurityfocus.com
Apr 26, 2017The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction sizCVE-2017-8284 · Other software · Qemu · reported by MITREHigh 7
The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
- Product
- Qemu
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.chromium.orggithub.com
Apr 26, 2017dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which CVE-2017-8283 · Other software · Debian · reported by MITRECritical 9.8
dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.
- Product
- Dpkg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Apr 24, 2017Controller throws an exception and does not allow user to add subsequent flow for a particular switch.CVE-2017-1000358 · Other software · Opendaylight · reported by MITREMedium 6.5
Controller throws an exception and does not allow user to add subsequent flow for a particular switch. Component: OpenDaylight odl-restconf feature contains this flaw. Version: OpenDaylight 4.0 is affected by this flaw.
- Product
- Opendaylight
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaaltodoc.aalto.fiaaltodoc.aalto.fi
Apr 24, 2017analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial oCVE-2015-1522 · Other software · BRO · reported by MITREHigh 7.5
analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not reject certain non-zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.
- Product
- BRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2017analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of sCVE-2015-1521 · Other software · BRO · reported by MITREHigh 7.5
analyzer/protocol/dnp3/DNP3.cc in Bro before 2.3.2 does not properly handle zero values of a packet length, which allows remote attackers to cause a denial of service (buffer overflow or buffer over-read if NDEBUG; otherwise assertion failure) via a crafted DNP3 packet.
- Product
- BRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 24, 2017sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for reaCVE-2014-9680 · Other software · Sudo Project · reported by MITRELow 3.3
sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access (but not view file contents) by running a program within an sudo session, as demonstrated by interfering with terminal output, discarding kernel-log messages, or repositioning tape drives.
- Product
- Sudo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comrhn.redhat.com
Apr 24, 2017drivers/media/video/videobuf-vmalloc.c in the Linux kernel before 2.6.24 does not initialize videobuf_mapping data structures, which allows local users to triggCVE-2007-6761 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
drivers/media/video/videobuf-vmalloc.c in the Linux kernel before 2.6.24 does not initialize videobuf_mapping data structures, which allows local users to trigger an incorrect count value and videobuf leak via unspecified vectors, a different vulnerability than CVE-2010-5321.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlinuxgrill.comsecurityfocus.com
Apr 23, 2017The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zeCVE-2017-8072 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
The cp2112_gpio_direction_input function in drivers/hid/hid-cp2112.c in the Linux kernel 4.9.x before 4.9.9 does not have the expected EIO error status for a zero-length report, which allows local users to have an unspecified impact via unknown vectors.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkernel.orgopenwall.com
Apr 21, 2017Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.CVE-2016-3067 · Other software · Cygwin · reported by Red HatCritical 9.8
Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.
- Product
- Cygwin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers tCVE-2016-1520 · Other software · Grandstream · reported by cret@cert.orgHigh 7.8
The Grandstream Wave app 1.0.1.26 and earlier for Android does not use HTTPS when retrieving update information, which might allow man-in-the-middle attackers to execute arbitrary code via a crafted application.
- Product
- Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Apr 21, 2017The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-tCVE-2016-1519 · Other software · Grandstream · reported by cret@cert.orgMedium 5.9
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.
- Product
- Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Apr 21, 2017Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiCVE-2016-1221 · Other software · Jetstar · reported by vultures@jpcert.or.jpMedium 5.9
Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Jetstar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof CVE-2016-1210 · Other software · The Hyakugo Bank · reported by vultures@jpcert.or.jpMedium 5.9
The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- 105 Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Photopt for Android before 2.0.1 does not verify SSL certificates.CVE-2016-1198 · Other software · NTT · reported by vultures@jpcert.or.jpMedium 5.9
Photopt for Android before 2.0.1 does not verify SSL certificates.
- Product
- Photopt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.CVE-2016-1187 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.8
Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
- Product
- Kunai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.CVE-2016-1186 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 5.9
Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
- Product
- Kintone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.CVE-2016-4832 · Other software · Aeon · reported by vultures@jpcert.or.jpMedium 5.9
WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
- Product
- Waon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.CVE-2016-4829 · Other software · DMM · reported by vultures@jpcert.or.jpMedium 5.9
DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.
- Product
- PPV Play Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.CVE-2016-1148 · Other software · Photosynth · reported by vultures@jpcert.or.jpHigh 8.1
Akerun - Smart Lock Robot App for iOS before 1.2.4 does not verify SSL certificates.
- Product
- Akerun
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2017Cybozu Garoon before 4.2.2 does not properly restrict access.CVE-2016-1220 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 4.3
Cybozu Garoon before 4.2.2 does not properly restrict access.
- Product
- Garoon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.