2014

WebKit in Apple iOS before 8 makes it easier for remote attackers to track users during private browsing via a crafted w

The rt_setgate function in the kernel in Apple iOS before 8 and Apple TV before 7 allows local users to gain privileges

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly initialize kernel memory, which allows attackers to

IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged conte

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitr

Integer overflow in IOKit in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a pr

IOKit in Apple iOS before 8 and Apple TV before 7 does not properly validate IODataQueue object metadata, which allows a

Race condition in the App Installation feature in Apple iOS before 8 allows local users to gain privileges and install u

Directory traversal vulnerability in the App Installation feature in Apple iOS before 8 allows local users to install un

The Assets subsystem in Apple iOS before 8 and Apple TV before 7 allows man-in-the-middle attackers to spoof a device's

Libnotify in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write operations, which allows att

The IOHIDFamily kernel extension in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking on write opera

An unspecified IOHIDFamily function in Apple iOS before 8 and Apple TV before 7 lacks proper bounds checking to prevent

CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or caus

Integer overflow in CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to execute arbitrar

Double free vulnerability in Apple iOS before 8 and Apple TV before 7 allows local users to gain privileges or cause a d

NSXMLParser in Foundation in Apple iOS before 8 allows attackers to read arbitrary files via XML data containing an exte

The IntelAccelerator driver in the IOAcceleratorFamily subsystem in Apple iOS before 8 and Apple TV before 7 allows atta

syslogd in the syslog subsystem in Apple iOS before 8 and Apple TV before 7 allows local users to change the permissions

The network-statistics interface in the kernel in Apple iOS before 8 and Apple TV before 7 does not properly initialize

The IOAcceleratorFamily API implementation in Apple iOS before 8 and Apple TV before 7 allows attackers to cause a denia

The Accessibility subsystem in Apple iOS before 8 allows attackers to interfere with screen locking via vectors related

Apple iOS before 8 enables Voice Dial during all upgrade actions, which makes it easier for physically proximate attacke

Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote

The 802.1X subsystem in Apple iOS before 8 and Apple TV before 7 does not require strong authentication methods, which a

Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms, which allows remote attac

The Sandbox Profiles implementation in Apple iOS before 8 does not properly restrict the third-party app sandbox profile

The Home & Lock Screen subsystem in Apple iOS before 8 does not properly restrict the private API for app prominence, wh

Accounts Framework in Apple iOS before 8 and Apple TV before 7 allows attackers to obtain sensitive information by readi

Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which

Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass in

Race condition in iMessage in Apple iOS before 8 allows attackers to obtain sensitive information by leveraging the pres

Address Book in Apple iOS before 8 relies on the hardware UID for its encryption key, which makes it easier for physical

GKSu 2.0.2, when sudo-mode is not enabled, uses " (double quote) characters in a gksu-run-helper argument, which allows

Multiple cross-site scripting (XSS) vulnerabilities in SpiceWorks 5.3.75941 allow remote attackers to inject arbitrary w

SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands

Cross-site scripting (XSS) vulnerability in the frontend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x befo

Cross-site scripting (XSS) vulnerability in the backend in Open-Xchange (OX) AppSuite before 7.4.2-rev33 and 7.6.x befor

Cross-site scripting (XSS) vulnerability in Mini Mail Dashboard Widget plugin 1.42 for WordPress allows remote attackers

Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary w

SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows r

Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow

Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote

The Secret Circle - talk freely (aka com.easyxapp.secret) application 2.2.00.26 for Android does not verify X.509 certif

The Slideshow 365 (aka com.Slideshow) application 3.6 for Android does not verify X.509 certificates from SSL servers, w

The Minha Oi (aka br.com.mobicare.minhaoi) application 1.15.0 for Android does not verify X.509 certificates from SSL se

The Tigo Copa Mundial FIFA 2014 (aka com.fwc2014.millicom.and) application 3.1 for Android does not verify X.509 certifi

The Finansbank Cep Subesi (aka com.finansbank.mobile.cepsube) application 1.1.5 for Android does not verify X.509 certif

The Allies in War (aka com.gamelion.aiw) application 1.3.2 for Android does not verify X.509 certificates from SSL serve

The InNote (aka com.intsig.notes) application 1.0.3.20131119 for Android does not verify X.509 certificates from SSL ser