CVE-2014-7019

The Clarks Inn aka com.ClarksInn application 3.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7025

The Who-is-it? Lite name caller time limited free aka de.profiler.android.whoisit application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6993

The Codeeta Coupons aka com.codeeta.promos application 1.0.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6998

The PinkFong TV aka kr.co.smartstudy.pinkfongtvandroidgooglemarket application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7004

The PETA aka com.peta.android application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7006

The HydFM aka com.apheliontechnologies.hydfm application 1.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6970

The North American Ismaili Games aka hr.apps.n166983741 application 5.26.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Server side request forgery (ssrf)

The Hardest Game Collection aka com.lotfun.abuse application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6959

The QinCard aka com.haowan.qincard application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6996

The Martial Arts Battle Card aka com.tapenjoy.zjh.tw application 1.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6998

The PinkFong TV aka kr.co.smartstudy.pinkfongtvandroidgooglemarket application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7024

The Hardest Game Collection aka com.lotfun.abuse application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7041

The SimGene aka com.japanbioinformatics.simgene application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6968

CVE-2014-6968 affects the Android app Grandma’s Grotto (com.mobileappsuite.grandmasgrotto) version 1. The root cause is the app not verifying X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The ...

CVE-2014-6976

CVE-2014-6976 affects the Android app Aeroexpress (aka ru.lynx.aero) version 2.6.2. The root cause is that the application does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The vulnerability im...

CVE-2014-7010

The CVE-2014-7010 entry concerns the UTSA Mobile Android app (com.dub.app.utsa) version 1.4.21, which does not verify X.509 certificates from SSL servers. This flaw enables man-in-the-middle attackers to spoof servers and access sensitive information via a crafted certificate. The available conne...

OpenSSL Releases Patch for POODLE Attack

The OpenSSL Project has released a new version of the encryption software, which patches several security flaws, including the bug that is exploited by the POODLE attack on SSLv3. The updated versions of OpenSSL come just a couple of days after a trio of researchers at Google revealed the POODLE...

Important: nss

Issue Overview: A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. This flaw allows a man-in-the-middle MITM attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are abl...

PT-2014-7672

Name of the Vulnerable Software and Affected Versions The Martial Arts Battle Card aka com.tapenjoy.zjh.tw version 1.0.9 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

PT-2014-7640

Name of the Vulnerable Software and Affected Versions Hanyang University Admissions aka kr.ac.hanyang.planner version 2.1.3 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a...