CVE-2014-6749

The American Nurses Association aka com.dub.poweredbydub.assoc.ana application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Sucuri: Usage of HTTP for exporting graph data as images

Whenever a user of waf.sucuri.net exports his reports graph data as a png, an unencrypted request is sent over to export.highcharts.com. This enables a mitm-able attacker to sniff and|or replace exported image. Also, the whole practice of offloading potentially private user data to an unrelated...

CVE-2014-6740

The XD Forum aka com.tapatalk.xdforumcomforum application 3.9.17 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6738

The CVE-2014-6738 entry concerns the Maccabi Tel Aviv Android app (com.monkeytech.maccabi) version 1.0, which does not verify X.509 certificates when communicating with SSL servers. The root cause is missing certificate validation, enabling man-in-the-middle attackers to spoof servers and access ...

CVE-2014-6747

The CVE-2014-6747 entry describes the Android SeeOn (com.seeon) application, version 4.0.7, as not verifying X.509 certificates when establishing SSL connections. This causes a trust/validation bypass that enables man-in-the-middle attackers to spoof servers and access sensitive information via a...

CVE-2014-6730

The Melodigram aka com.minusdegree.melodigramandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Soap Making aka com.tapatalk.soapmakingforumcom application 3.7.13 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The 30A aka com.app30a application 5.26.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Comics Plus aka com.iversecomics.comicsplus.android application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6723

The Comics Plus aka com.iversecomics.comicsplus.android application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6733

CVE-2014-6733 affects the My T-Mobile (at.tmobile.android.myt) Android app. The app does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. No exploitation details or patch information are provided i...

PT-2014-7405

Name of the Vulnerable Software and Affected Versions The Mikeius Official App version 1.4.2.0 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Leadership Newspapers aka com.LeadershipNewspapers application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Cross site request forgery (csrf)

The Voices.com aka com.voices.voices application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6650

The NextGenUpdate aka com.tapatalk.nextgenupdatecomforums application 3.1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6659

The CVE-2014-6659 entry concerns the Android Defence.pk (com.tapatalk.defencepkforums) app, version 2.4.13.1, which does not verify X.509 certificates when connecting to SSL servers. The underlying issue is the app’s failure to validate server certificates, enabling man-in-the-middle attackers to...

PT-2014-7342

Name of the Vulnerable Software and Affected Versions The Latin Angels Music HD aka com.applizards.lafreetj version 2.0 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

PT-2014-7354

Name of the Vulnerable Software and Affected Versions Exercitii pentru abdomen aka com.rareartifact.exercitiipentruabdomen41E29322 version 1.0 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitiv...

IBM Domino 9.0.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities (credentialed check) (POODLE)

The version of IBM Domino formerly Lotus Domino installed on the remote host is 9.0.x prior to 9.0.1 Fix Pack 2 FP2. It is, therefore, affected by the following vulnerabilities : - An unspecified error exists related to the TLS implementation and the IBM HTTP server that could allow certain error...

Design/Logic Flaw

The Gravity Bounce aka net.toddm.gb application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...