PT-2014-6569

Name of the Vulnerable Software and Affected Versions BeenVerified application version 4.01.67 Description The issue concerns the BeenVerified application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-6661

Name of the Vulnerable Software and Affected Versions The Township aka com.playrix.township version 1.5.1 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

PT-2014-6514

Name of the Vulnerable Software and Affected Versions Appsflyer library for Android affected versions not specified Description The issue concerns the Appsflyer library for Android, which fails to verify X.509 certificates from SSL servers. This oversight allows man-in-the-middle attackers to spo...

PT-2014-6808

Name of the Vulnerable Software and Affected Versions The Cleaner - Speed up & Clean aka com.liquidum.thecleaner version 1.4.2 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not veri...

PT-2014-6657

Name of the Vulnerable Software and Affected Versions NQ Mobile Security & Antivirus version 7.2.16.00 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from S...

PT-2014-6710

Name of the Vulnerable Software and Affected Versions Truecaller - Caller ID & Block aka com.truecaller version 4.32 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

PT-2014-6719

Name of the Vulnerable Software and Affected Versions The Buy Books aka com.wBooksForSale application version 0.1 Description The issue concerns the application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-6772

Name of the Vulnerable Software and Affected Versions The Ninja Chicken application version 1.7.6 Description The issue concerns the application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

jakarta-commons-httpclient security update

1:3.1-16 - Fix MITM security vulnerability - Resolves: CVE-2014-3577...

New Firefox 32 Adds Protection Against MiTM Attack and Rogue Certificates

Good news for Firefox lovers! The Mozilla Foundation has introduced a bunch of new features in Firefox to improve browser security with the launch of Firefox 32, now available for Windows, Mac, Linux, and Android platforms. The new version of Firefox makes the browser even more competitive among...

UBUNTU-CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

httpcomponents-client security update

4.2.5-5 - Fix MITM security vulnerability - Resolves: CVE-2014-3577...

Multiple Android applications fail to properly validate SSL certificates

Overview Multiple Android applications fail to properly validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle MITM attack. Description When communicating via HTTPS, an application should validate the SSL chain to be sure that the...

Mozilla to Support Key Pinning in Firefox 32

Mozilla is planning to add support for public-key pinning in its Firefox browser in an upcoming version. In version 32, which would be the next stable version of the browser, Firefox will have key pins for a long list of sites, including many of Mozilla’s own sites, all of the sites pinned in...

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

DEBIAN-CVE-2014-3577

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2014-3577: Undefined Security Weakness

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2014-3577

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

Viproy v2.0 - VoIP Penetration Testing and Exploitation Kit

Viproy Voip Pen-Test Kit provides penetration testing modules for VoIP networks. It supports signalling analysis for SIP and Skinny protocols, IP phone services and network infrastructure. Viproy 2.0 is released at Blackhat Arsenal USA 2014 with TCP/TLS support for SIP, vendor extentions support,...