CVE-2014-6659

The Defence.pk aka com.tapatalk.defencepkforums application 2.4.13.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6654

The wTrootrooTvIzle aka com.wTrootrooTvIzle application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6687

The wSaudichannelAlNasr aka com.wSaudichannelAlNasr application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6681

The Mahabharata Audiocast aka com.wordbox.mahabharataAudiocast application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6651

The Planet of the Vapes Forum aka com.tapatalk.planetofthevapescoukforums application 3.7.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

MyFitnessPal App Patches Privacy Vulnerability

The details of a patched vulnerability in a popular mobile fitness application have been disclosed three months after a fixed was released. The flaw could have allowed a user to fetch the personal profile of another registered app user. MyFitnessPal deployed a fix on June 26 for a privacy flaw in...

CVE-2014-6002

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Harley-Davidson Visa aka com.usbank.icsmobile.harleydavidson application 1.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The autonavi aka com.telenav.doudouyou.android.autonavi application 4.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The psychology aka com.alek.psychology application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The global beauty research aka com.appems.topgirl application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Belas Frases de Amor aka com.goodbarber.frasesdeamor application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6002

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5991

The Skin Conditions and Diseases aka com.appsgeyser.wSkinConditions application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5996

The DEKRA Used Car Report aka com.dekra.maengelreport application 3.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6643

The FIAT Forum aka com.tapatalk.fiatforumcom application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6014

The CVE-2014-6014 entry affects the Android app “The Conquest Of Fantasia” (package air.com.ingen.studios.cof.sg) v1.0.1. Root cause: the app fails to verify X.509 certificates when connecting to SSL servers, enabling man-in-the-middle attackers to spoof servers and read sensitive data via a craf...

CVE-2014-6642

The CVE concerns the Android app for The Mark’s Daily Apple Forum (com.tapatalk.marksdailyapplecomforum) v2.4.9.3, where the implementation does not verify X.509 certificates from SSL servers. This lack of certificate verification enables man-in-the-middle attackers to spoof servers and exfiltrat...

CVE-2014-5994

The CVE-2014-5994 entry concerns the Android app “ding* ezetop. Top-up Any Phone” (package com.ezetop.world) version 1.3.4, where SSL validation is not performed for X.509 certificates. This permits MITM attackers to spoof servers and capture sensitive information via a crafted certificate. The c...