CVE-2014-6688

The Voices.com Android app (com.voices.voices) version 1.5 does not verify X.509 certificates from SSL/TLS servers, allowing MITM attackers to spoof servers and read sensitive data via a crafted certificate. According to CVE-2014-6688 data, this yields a Medium impact with partial confidentiality...

CVE-2014-6687

The wSaudichannelAlNasr aka com.wSaudichannelAlNasr application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

MyFitnessPal App Patches Privacy Vulnerability

The details of a patched vulnerability in a popular mobile fitness application have been disclosed three months after a fixed was released. The flaw could have allowed a user to fetch the personal profile of another registered app user. MyFitnessPal deployed a fix on June 26 for a privacy flaw in...

CVE-2014-6002

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The psychology aka com.alek.psychology application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The autonavi aka com.telenav.doudouyou.android.autonavi application 4.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Harley-Davidson Visa aka com.usbank.icsmobile.harleydavidson application 1.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The global beauty research aka com.appems.topgirl application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Belas Frases de Amor aka com.goodbarber.frasesdeamor application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6643

The FIAT Forum aka com.tapatalk.fiatforumcom application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6002

The DTE Energy aka com.dteenergy.mydte application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5996

The DEKRA Used Car Report aka com.dekra.maengelreport application 3.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5991

The Skin Conditions and Diseases aka com.appsgeyser.wSkinConditions application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6014

The CVE-2014-6014 entry affects the Android app “The Conquest Of Fantasia” (package air.com.ingen.studios.cof.sg) v1.0.1. Root cause: the app fails to verify X.509 certificates when connecting to SSL servers, enabling man-in-the-middle attackers to spoof servers and read sensitive data via a craf...

CVE-2014-6017

The Doodle Drop aka net.lazyer.DoodleDrop application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6642

The CVE concerns the Android app for The Mark’s Daily Apple Forum (com.tapatalk.marksdailyapplecomforum) v2.4.9.3, where the implementation does not verify X.509 certificates from SSL servers. This lack of certificate verification enables man-in-the-middle attackers to spoof servers and exfiltrat...

CVE-2014-6637

The CVE-2014-6637 entry concerns the Facebook Facts (com.wFacebookFacts) Android app 0.1, which does not verify X.509 certificates when establishing TLS connections. This improper certificate validation enables man-in-the-middle attackers to spoof SSL servers and exfiltrate sensitive information ...

CVE-2014-5994

The CVE-2014-5994 entry concerns the Android app “ding* ezetop. Top-up Any Phone” (package com.ezetop.world) version 1.3.4, where SSL validation is not performed for X.509 certificates. This permits MITM attackers to spoof servers and capture sensitive information via a crafted certificate. The c...

Yuko Yuko App for Android fails to verify SSL server certificates

Overview Yuko Yuko App for Android provided by Yuko Yuko Corporation fails to verify SSL server certificates. Shunsuke Taniguchi of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...