CVE-2014-6738

The Maccabi Tel Aviv aka com.monkeytech.maccabi application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6746

The Infiniti Roadside Assistance aka com.ccas.rsa.common.infiniti application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6724

The Soap Making aka com.tapatalk.soapmakingforumcom application 3.7.13 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Pharmaguideline aka com.pharmaguideline application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6719

The CVE-2014-6719 entry concerns the Kayak Angler Magazine Android app (package air.com.yudu.ReaderAIR1360155) v3.12.0. Vulnerability: TLS certificate validation is not performed, i.e., the app does not verify X.509 certificates from SSL servers. Root cause: missing/incorrect TLS certificate vali...

Yahoo! Japan Box for Android issue where it fails to verify SSL server certificates

Overview Yahoo! Japan Box for Android provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Yahoo Japan Corporation reported this vulnerability to JPCERT/CC to notify users of this issue through JVN. JPCERT/CC coordinated with Yahoo Japan...

CVE-2014-6709

The TechRadar News aka com.techradar.news application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Embry-Riddle aka com.dub.app.erau application 1.4.04 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The SlotMachine aka com.popoinnovation.SlotMachine application 1.03 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6704

The CVE-2014-6704 entry affects the Android app Utah Jazz (package com.sportinginnovations.jazz) version 2.0.0. The vulnerability is a failure to verify X.509 SSL certificates when establishing TLS connections, which enables man-in-the-middle attackers to spoof servers and potentially leak sensit...

CVE-2014-6717

The CVE-2014-6717 vulnerability affects the iTriage Health Android app (package com.healthagen.iTriage) version 5.29. The issue is that the app does not verify X.509 certificates from SSL servers, creating a trust flaw that can enable man-in-the-middle attackers to spoof servers and obtain sensit...

CVE-2014-6702

The CVE-2014-6702 entry concerns the StarSat International Android app (package com.conduit.app_b15a1814d2d840198e70e3c235af5e8b.app), version 1.41.54.9222, which does not verify X.509 certificates from SSL servers. This implementation flaw allows man-in-the-middle attackers to spoof trusted serv...

CVE-2014-6714

The WebMD aka com.webmd.android application 3.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6702

The StarSat International aka com.conduit.appb15a1814d2d840198e70e3c235af5e8b.app application 1.41.54.9222 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6716

The fastin aka moda.azyae.fastin.net application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6694

The CVE-2014-6694 issue affects the Android app “5SOS Family Planet” (package uk.co.pixelkicks.fivesos) version 2.3.4, where the app does not verify X.509 certificates from SSL servers. This pluggable weakness enables man-in-the-middle attackers to spoof servers and obtain sensitive information v...

CVE-2014-6694

The 5SOS Family Planet aka uk.co.pixelkicks.fivesos application 2.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6693

The Juiker aka org.itri application 3.2.0829.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6699

The Weather Channel aka com.weather.Weather application 5.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6688

The Voices.com aka com.voices.voices application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...