2014

The Flick a Trade (aka air.com.cygnecode.fat) application 3.3 for Android does not verify X.509 certificates from SSL se

The Michael Baker FCU (aka air.com.creditunionhomebanking.mb155) application 1.2.0 for Android does not verify X.509 cer

The Westmoreland Water FCU (aka air.com.creditunionhomebanking.mb115) application 1.2.0 for Android does not verify X.50

The Abduction Stacker Free (aka air.com.chewygames.abductionstacker2) application 1.0.7 for Android does not verify X.50

The Bingo Bash - Free Bingo Casino (aka air.com.bitrhymes.bingo) application 1.31.1 for Android does not verify X.509 ce

The Baby Get Up - Kids Care (aka air.brown.jordansa.getup) application 1.0.3 for Android does not verify X.509 certifica

The Princess Shopping (aka air.android.PrincessShopping) application 2 for Android does not verify X.509 certificates fr

The Honolulu (aka adidas.jp.android.running.honolulu) application 2 for Android does not verify X.509 certificates from

The Abode (aka abode.webview) application 1.7 for Android does not verify X.509 certificates from SSL servers, which all

The Gameloft library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle att

The Appsflyer library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at

The Tapjoy library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attac

The Inmobi library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attac

The MoMinis library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atta

The Adcolony library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle att

Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 al

Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified,

Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obta

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack w

Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that trigger

The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote atta

The Netmaster CBW700N cable modem with software 81.447.392110.729.024 has an SNMP community of public, which allows remo

Emurasoft EmFTP allows local users to gain privileges via a Trojan horse executable file that is launched during an atte

Session fixation vulnerability in Falcon WisePoint 4.1.19.7 and earlier allows remote attackers to hijack web sessions v

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, whic

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity

IBM Cognos TM1 10.2.0.2 before IF1 and 10.2.2.0 before IF1 allows remote attackers to bypass intended access restriction

Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20

TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an e

TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies

Multiple integer overflows in the HelpServ module (mod-helpserv.c) in srvx 1.3.1 allow remote authenticated IRCops or He

The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used,

The client in IBM Cognos TM1 9.5.2.3 before IF5, 10.1.1.2 before IF1, 10.2.0.2 before IF1, and 10.2.2.0 before IF1 store

The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers

The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service

Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connectio

Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data

SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obt

Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attacker

ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user acc

Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to b

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumpt

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file contai

expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and exe

The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zen

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server h

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attac

Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum be