rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-3797 
Pro-face WinGP PC Runtime 3.1.00 and earlier, and ProServr.exe in Pro-face Pro-Server EX 1.30.000 and earlier, does not properly check packet sizes before reusing packet memory buffers, which allows remote attackers to cause a denial of service (heap memory corruption) or possibly have unspecified other impact via a short crafted packet with a certain opcode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-25T17:00:00.000Z
CVE-2012-3798 
The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-3799 
Multiple cross-site request forgery (CSRF) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) change workflows or (2) insert cross-site scripting (XSS) sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-3800 
Cross-site scripting (XSS) vulnerability in og.js in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal, when used with the Vertical Tabs module, allows remote authenticated users to inject arbitrary web script or HTML via vectors related the group title.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T00:00:00.000Z
CVE-2012-3802 
Unspecified vulnerability in the Post Affiliate Pro (PAP) module for Drupal allows remote authenticated users to read the commissions of other users via unknown attack vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T18:00:00.000Z
CVE-2012-3805 
Multiple cross-site scripting (XSS) vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) absender_name, (2) absender_email, or (3) absender_nachricht parameter to the content page; (4) comment_name, (5) comment_subject, or (6) comment_message parameter to the postacomment module; (7) module parameter to index.php; (8) action parameter to the admin login page; (9) pv or (10) pe parameter in a list action to the user module; (11) user_username, (12) user_email, (13) user_forename, (14) user_name, (15) user_street, (16) user_postal, (17) user_city, (18) user_tel, or (19) user_mobil parameter in a newUser action to the user module; (20) group_name or (21) group_desc parameter in a groupNew action to the user module; (22) name, (23) browsername, (24) seostring, (25) keywords, or (26) folder_id parameter in a newPage action to the pages module; (27) element_name or (28) element_cachetime parameter in a newElement action in the pages module; (29) aspect_name parameter in a newAspect action in the system module; (30) filemanager_name, (31) filemanager_path, (32) filemanager_upload_filter, or (33) filemanager_view_filter parameter in a NewRepo action to the filemanager module; or (34) archive_title or (35) archive_path parameter in a newArchive action to the downloads module.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T19:00:00.000Z
CVE-2012-3806 
Samsung Kies before 2.5.0.12094_27_11 contains a NULL pointer dereference vulnerability which could allow remote attackers to perform a denial of service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:34:30.000Z
CVE-2012-3807 
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:48:52.000Z
CVE-2012-3808 
Samsung Kies before 2.5.0.12094_27_11 has arbitrary file modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:51:14.000Z
CVE-2012-3809 
Samsung Kies before 2.5.0.12094_27_11 has arbitrary directory modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:54:07.000Z
CVE-2012-3810 
Samsung Kies before 2.5.0.12094_27_11 has registry modification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-09T21:56:09.000Z
CVE-2012-3811 
Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code by uploading an executable file and then accessing it via a direct request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T19:00:00.000Z
CVE-2012-3812 
Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users to cause a denial of service (daemon crash) by establishing multiple voicemail sessions and accessing both the Urgent mailbox and the INBOX mailbox.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-09T22:00:00.000Z
CVE-2012-3814 
Unrestricted file upload vulnerability in font-upload.php in the Font Uploader plugin 1.2.4 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file with a .php.ttf extension, then accessing it via a direct request to the file in font-uploader/fonts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T21:00:00.000Z
CVE-2012-3815 
Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 46824.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T21:00:00.000Z
CVE-2012-3816 
WinRadius Server 2009 allows remote attackers to cause a denial of service (crash) via a long password in an Access-Request packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-27T21:00:00.000Z
CVE-2012-3817 
ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T10:00:00.000Z
CVE-2012-3818 
The fpm exporter in Revelation 0.4.13-2 and earlier encrypts the version number but not the password when exporting a file, which might allow local users to obtain sensitive information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-29T17:00:00.000Z
CVE-2012-3819 
Stack consumption vulnerability in dartwebserver.dll 1.9 and earlier, as used in Dart PowerTCP WebServer for ActiveX and other products, allows remote attackers to cause a denial of service (daemon crash) via a long request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-10-04T10:00:00.000Z
CVE-2012-3820 
Multiple SQL injection vulnerabilities in Campaign11.exe in Arial Software Campaign Enterprise before 11.0.551 allow remote attackers to execute arbitrary SQL commands via the (1) SerialNumber field to activate.asp or (2) UID field to User-Edit.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-08-14T14:00:00.000Z
CVE-2012-3821 
A Security Bypass vulnerability exists in the activate.asp page in Arial Software Campaign Enterprise 11.0.551, which could let a remote malicious user modify the SerialNumber field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T19:21:51.000Z
CVE-2012-3822 
Arial Campaign Enterprise before 11.0.551 has unauthorized access to the User-Edit.asp page, which allows remote attackers to enumerate users' credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T16:49:44.000Z
CVE-2012-3823 
Arial Campaign Enterprise before 11.0.551 stores passwords in clear text and these may be retrieved.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T16:52:44.000Z
CVE-2012-3824 
In Arial Campaign Enterprise before 11.0.551, multiple pages are accessible without authentication or authorization.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-10T16:55:11.000Z
CVE-2012-3825 
Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI dissectors, a different vulnerability than CVE-2012-2392.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-30T10:00:00.000Z
CVE-2012-3826 
Multiple integer underflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (loop) via vectors related to the R3 dissector, a different vulnerability than CVE-2012-2392.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-06-30T10:00:00.000Z
CVE-2012-3828 
Cross-site scripting (XSS) vulnerability in Joomla! 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the Host HTTP Header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3829 
Joomla! 2.5.3 allows remote attackers to obtain the installation path via the Host HTTP Header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3830 
Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via the video directive.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3831 
Cross-site scripting (XSS) vulnerability in decoda/templates/video.php in Decoda before 3.3.1 allows remote attackers to inject arbitrary web script or HTML via multiple URLs in an img tag.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3832 
Cross-site scripting (XSS) vulnerability in decoda/Decoda.php in Decoda before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to (1) b or (2) div tags.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3833 
Cross-site scripting (XSS) vulnerability in the default index page in admin/ in Quick.CMS 4.0 allows remote attackers to inject arbitrary web script or HTML via the p parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3834 
SQL injection vulnerability in forensics/base_qry_main.php in AlienVault Open Source Security Information Management (OSSIM) 3.1 allows remote authenticated users to execute arbitrary SQL commands via the time[0][0] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3835 
Multiple cross-site scripting (XSS) vulnerabilities in AlienVault Open Source Security Information Management (OSSIM) 3.1 allow remote attackers to inject arbitrary web script or HTML via the (1) url parameter to top.php or (2) time[0][0] parameter to forensics/base_qry_main.php, which is not properly handled in an error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3836 
Multiple cross-site scripting (XSS) vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) groupname parameter in a savecategory in the users module; (2) virtual_filename, (3) branch, (4) contact_person, (5) street, (6) city, (7) province, (8) postal, (9) country, (10) tollfree, (11) phone, (12) fax, or (13) mobile parameter in a saveitem action in the contacts module; (14) title parameter in a savecategory action in the menus module; (15) firstname or (16) lastname in a saveitem action in the users module; (17) meta_key or (18) meta_description in a saveitem action in the blog module; or (19) the PATH_INFO to admin/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3837 
Multiple cross-site scripting (XSS) vulnerabilities in apps/users/registration.template.php in Baby Gekko 1.2.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) email_address, (3) password, (4) password_verify, (5) firstname, (6) lastname, or (7) verification_code parameter to users/action/register.  NOTE: some of these details are obtained from third party information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3838 
Gekko before 1.2.0 allows remote attackers to obtain the installation path via a direct request to (1) admin/templates/babygekko/index.php or (2) templates/html5demo/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3839 
Multiple SQL injection vulnerabilities in application/core/MY_Model.php in MyClientBase 0.12 allow remote attackers to execute arbitrary SQL commands via the (1) invoice_number or (2) tags parameter to index.php/invoice_search.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3840 
Multiple cross-site scripting (XSS) vulnerabilities in index.php/users/form/user_id in MyClientBase 0.12 allow remote attackers to inject arbitrary web script or HTML via the (1) first_name or (2) last_name parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3841 
Untrusted search path vulnerability in KMPlayer 3.2.0.19 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ehtrace.dll that is located in the current working directory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3842 
Multiple cross-site scripting (XSS) vulnerabilities in CMD_DOMAIN in JBMC Software DirectAdmin 1.403 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) select0 or (2) select8 parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3843 
Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3844 
Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3845 
Buffer overflow in LAN Messenger 1.2.28 and earlier allows remote attackers to cause a denial of service (crash) via a long string in an initiation request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3846 
Cross-site scripting (XSS) vulnerability in index.php in PHP-pastebin 2.1 allows remote attackers to inject arbitrary web script or HTML via the title parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-03T22:00:00.000Z
CVE-2012-3847 
slssvc.exe in Invensys Wonderware SuiteLink in Invensys InTouch 2012 and Wonderware Application Server 2012 allows remote attackers to cause a denial of service (resource consumption) via a long Unicode string, a different vulnerability than CVE-2012-3007.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-05T01:00:00.000Z
CVE-2012-3848 
Multiple cross-site scripting (XSS) vulnerabilities in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to d4d/exporters.php, (2) the HTTP Referer header to d4d/exporters.php, or (3) unspecified input to d4d/contextMenu.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-31T10:00:00.000Z
CVE-2012-3859 
Unspecified vulnerability in the WebAdmin Portal in Netsweeper has unknown impact and attack vectors, a different vulnerability than CVE-2012-2446 and CVE-2012-2447.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-09T18:00:00.000Z
CVE-2012-3863 
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-09T10:00:00.000Z
CVE-2012-3864 
Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-06T16:00:00.000Z
CVE-2012-3865 
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-06T16:00:00.000Z
CVE-2012-3866 
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-06T16:00:00.000Z
CVE-2012-3867 
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-06T16:00:00.000Z
CVE-2012-3868 
Race condition in the ns_client structure management in ISC BIND 9.9.x before 9.9.1-P2 allows remote attackers to cause a denial of service (memory consumption or process exit) via a large volume of TCP queries.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-25T10:00:00.000Z
CVE-2012-3869 
Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-08-13T20:00:00.000Z
CVE-2012-3870 
Multiple cross-site scripting (XSS) vulnerabilities in objects/createobject.php in Open Constructor 3.12.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) name or (2) description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-28T11:00:00.000Z
CVE-2012-3871 
Cross-site scripting (XSS) vulnerability in data/hybrid/i_hybrid.php in Open Constructor 3.12.0 allows remote authenticated users to inject arbitrary web script or HTML via the header parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-28T11:00:00.000Z
CVE-2012-3872 
Multiple cross-site scripting (XSS) vulnerabilities in Open Constructor 3.12.0 allow remote attackers to inject arbitrary web script or HTML via (1) the result parameter to data/file/edit.php, (2) the q parameter to confirm.php, or (3) the keyword parameter to users/users.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-28T11:00:00.000Z
CVE-2012-3873 
Multiple SQL injection vulnerabilities in Open Constructor 3.12.0 allow remote authenticated users to execute arbitrary SQL commands via the id parameter to (1) data/gallery/edit.php, (2) data/guestbook/edit.php, (3) data/file/edit.php, (4) data/htmltext/edit.php, (5) data/publication/edit.php, or (6) data/event/edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-28T11:00:00.000Z
CVE-2012-3881 
Multiple SQL injection vulnerabilities in RTG 0.7.4 and RTG2 0.9.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) 95.php, (2) view.php, or (3) rtg.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-12T19:00:00.000Z
CVE-2012-3884 
AirDroid 1.0.4 beta implements authentication through direct transmission of a password hash over HTTP, which makes it easier for remote attackers to obtain access by sniffing the local wireless network and then replaying the authentication data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T22:00:00.000Z
CVE-2012-3885 
The default configuration of AirDroid 1.0.4 beta uses a four-character alphanumeric password, which makes it easier for remote attackers to obtain access via a brute-force attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T22:00:00.000Z
CVE-2012-3886 
AirDroid 1.0.4 beta uses the MD5 algorithm for values in the checklogin key parameter and 7bb cookie, which makes it easier for remote attackers to obtain cleartext data by sniffing the local wireless network and then conducting a (1) brute-force attack or (2) rainbow-table attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T22:00:00.000Z
CVE-2012-3887 
AirDroid before 1.0.7 beta uses a cleartext base64 format for data transfer that is documented as an "Encrypted Transmission" feature, which allows remote attackers to obtain sensitive information by sniffing the local wireless network, as demonstrated by the SMS message content sent to the sdctl/sms/send/single/ URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-07-26T22:00:00.000Z