CVE List
| Id | CVE No. | Status | Description | Phase | Votes | Comments | Actions |
|---|---|---|---|---|---|---|---|
| 74728 | CVE-2014-7427 | Candidate | The Hunting Trophy Whitetails (aka com.wHuntingTrophyWhitetails) application 0.75.13441.88885 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | Assigned (20141003) | None (candidate not yet proposed) | View | |
| 9448 | CVE-2004-1020 | Candidate | The addslashes function in PHP 4.3.9 does not properly escape a NULL (/0) character, which may allow remote attackers to read arbitrary files in PHP applications that contain a directory traversal vulnerability in require or include statements, but are otherwise protected by the magic_quotes_gpc mechanism. NOTE: this issue was originally REJECTed by its CNA before publication, but that decision is in active dispute. This candidate may change significantly in the future as a result of further discussion. | Assigned (20041104) | REVIEWING(1) Christey | Christey> There is active disagreement regarding whether this satisfies the | criteria for inclusion in CVE, because the attack vectors require | function parameters that are typically controlled only by the | application developer, not an external attacker. This would mean that | only the PHP application owner could exploit it. | | Since the application developer presumably already has acccess | to the underlying file system, directory traversal attacks provide no | additional access to the application owner. Therefore, this candidate | would only be valid if there are cases in which the attacker can | inject a null character into a string that is processed by addslashes. | View |
| 74984 | CVE-2014-7683 | Candidate | The Free Canadian Author Previews (aka com.booksellerscanada.authorpreview) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. | Assigned (20141003) | None (candidate not yet proposed) | View | |
| 9704 | CVE-2004-1276 | Candidate | IglooFTP 0.6.1, when recursively uploading a directory, allows local users to overwrite the files that are being uploaded by creating temporary files with names generated by the tmpnam function, before the files are opened by IglooFTP. | Assigned (20041220) | None (candidate not yet proposed) | View | |
| 75240 | CVE-2014-7939 | Candidate | Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and console.log calls, related to HTTP responses that lack an "X-Content-Type-Options: nosniff" header. | Assigned (20141006) | None (candidate not yet proposed) | View |
Page 19046 of 20943, showing 5 records out of 104715 total, starting on record 95226, ending on 95230
