Design/Logic Flaw

The Industrial and Commercial Bank of China ICBC Banking aka com.icbc.android application 2.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7589

The Industrial and Commercial Bank of China ICBC Banking aka com.icbc.android application 2.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7589

The CVE-2014-7589 entry concerns the ICBC Banking Android app (com.icbc.android) version 2.40, where the app does not verify X.509 certificates from SSL servers. This missing certificate validation can allow a man-in-the-middle to spoof servers and exfiltrate sensitive information via a crafted c...

PayPal Inc iOS Mobile 4.6.0 Input Validation

Document Title: =============== PayPal Inc 86 iOS 4.6 - Validation & Design Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=915 PayPal Security UID: eff8aq Release Date: ============= 2014-09-30 Vulnerability Laboratory ID VL-ID:...

CVE-2014-6875

The Woodforest Mobile Banking aka com.woodforest application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Woodforest Mobile Banking aka com.woodforest application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Santander Personal Banking aka com.sovereign.santander application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6875

CVE-2014-6875 affects the Woodforest Mobile Banking Android app (v3.1); the root cause is that the app does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Exploit status and fixes are not detailed...

CVE-2014-6877

The Santander Personal Banking aka com.sovereign.santander application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6875

The Woodforest Mobile Banking aka com.woodforest application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6877

The CVE-2014-6877 entry concerns the Santander Personal Banking Android app (version 2.1). The connected records confirm the root cause: the application does not verify X.509 certificates presented by SSL servers, which enables man-in-the-middle attackers to spoof servers and extract sensitive in...

CVE-2014-6732

The Westpac Mobile Banking aka org.westpac.bank application 5.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Westpac Mobile Banking aka org.westpac.bank application 5.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6732

The Westpac Mobile Banking aka org.westpac.bank application 5.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6732

The CVE-2014-6732 entry concerns the Westpac Mobile Banking Android app (version 5.21) that does not verify X.509 certificates when establishing SSL connections. This weakens server authentication and allows a man-in-the-middle to spoof SSL servers and capture sensitive information via a crafted ...

jQuery Official Website Compromised To Serve Malware

The official website of the popular cross-platform JavaScript library jQuery jquery.com has been compromised and redirecting its visitors to a third-party website hosting the RIG exploit kit, in order to distribute information-stealing malware. JQuery is a free and open source JavaScript library...

Dyre Trojan Targeting More than Salesforce.com Credentials

The criminals who unleashed a variant of the Dyre banking Trojan recently may have more up their sleeve than harvesting Salesforce.com credentials. Analysis of a sample conducted by SaaS security company Adallom determined that the new strain of Dyre is targeting large enterprises in addition to...

CVE-2014-5926

The DCU Mobile Banking aka com.Vertifi.Mobile.P211391825 application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5926

CVE-2014-5926 affects the DCU Mobile Banking Android app (com.Vertifi.Mobile.P211391825) and is due to the app not verifying X.509 certificates from SSL servers. This enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected doc...

Citadel Used in Attacks Against Petrochemical Companies

Cybercrime tools continue to crossover into the realm of nation-state targeted attacks, with the latest example being a variant of the Citadel banking Trojan used in attacks against petrochemical companies in the Middle East. The attacks took place within the past few months, said researchers at...