146 matches found
CVE-2014-5925
The CVE-2014-5925 entry concerns the Android app “10000 Kindle Books Downloads” (com.ww10000KindleBooksLatestnBestSellers) version 0.312, which does not verify X.509 certificates from SSL servers. This lack of certificate validation can allow a man-in-the-middle to spoof servers and obtain sensit...
The Kindle bookstore now vulnerabilities: hackers can control the user accounts-vulnerability warning-the black bar safety net
Security researchers recently found that the Amazon website appears a loophole, hack, or be able to take the allowed to login to Amazon user account. German researcher Benjamin Daniel Moos Le Benjamin Daniel Mussler in a blog post disclosing the vulnerability. He said, for hidden in the Kindle...
Malicious Kindle Ebook Let Hackers Take Over Your Amazon Account
If you came across a Kindle e-book download link from any suspicious sources or somewhere other than Amazon itself, check twice before you proceed download. As downloading an eBook could put your personal information at risk. A security researcher has uncovered a security hole in Amazon's Kindle...
Amazon Kindle for Android < 4.5.0 SSL Certificate Validation Security Bypass
Binary data 8373.prm...
CVE-2014-3908
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
CVE-2014-3908
CVE-2014-3908 affects the Kindle App for Android prior to version 4.5.0, which does not verify X.509 certificates from SSL servers. This insecure TLS validation can allow MITM attackers to spoof servers and obtain sensitive information via forged certificates. Public references from NVD/JVN confi...
CVE-2014-3908
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Information disclosure
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...
Kindle App for Android fails to verify SSL server certificates
Overview Kindle App for Android fails to verify SSL server certificates. Hiroshi Tokumaru of HASH Consulting Corp. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-middle attack may allow an...
JVN#17637243: Kindle App for Android fails to verify SSL server certificates
Kindle App for Android fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version according to the information provided by the developer. Products Affected...
CVE-2010-5268
Untrusted search path vulnerability in Amazon Kindle for PC 1.3.0 30884 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .azw file. NOTE: some of these details are obtained from third party...
Design/Logic Flaw
Untrusted search path vulnerability in Amazon Kindle for PC 1.3.0 30884 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .azw file. NOTE: some of these details are obtained from third party...
CVE-2010-5268
Untrusted search path vulnerability in Amazon Kindle for PC 1.3.0 30884 allows local users to gain privileges via a Trojan horse wintab32.dll in the current working directory, demonstrated by a directory containing a .azw file. Affected product: Amazon Kindle for PC; vulnerable component: wintab3...
CVE-2010-5268
Untrusted search path vulnerability in Amazon Kindle for PC 1.3.0 30884 allows local users to gain privileges via a Trojan horse wintab32.dll file in the current working directory, as demonstrated by a directory that contains a .azw file. NOTE: some of these details are obtained from third party...
CVE-2012-4249
The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than...
CVE-2012-4248
The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the 1 dev.log, 2 lipc.set, 3 lipc.get, or 4 todo.scheduleItems method, a different...
Design/Logic Flaw
The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the 1 dev.log, 2 lipc.set, 3 lipc.get, or 4 todo.scheduleItems method, a different...
Code injection
The Amazon Lab126 com.lab126.system sendEvent implementation on the Kindle Touch before 5.1.2 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, as demonstrated by using lipc-set-prop to set an LIPC property, a different vulnerability than...
CVE-2012-4248
The Amazon Kindle Touch before 5.1.2 does not properly restrict access to the libkindleplugin.so NPAPI plugin interface, which might allow remote attackers to have an unspecified impact via vectors involving the 1 dev.log, 2 lipc.set, 3 lipc.get, or 4 todo.scheduleItems method, a different...
CVE-2012-4249
The vulnerability CVE-2012-4249 affects Amazon Kindle Touch prior to 5.1.2, specifically the com.lab126.system sendEvent implementation. The issue allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a string, demonstrated by lipc-set-prop to set an LIPC pr...