CVE-2017-9588

CVE-2017-9588 affects the Oritani Mobile Banking iOS app (version 3.0.0, oritani-mobile-banking/id778851066). The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certifi...

CVE-2017-9574

The CVE-2017-9574 entry concerns the iOS app “KC Area Credit Union Mobile Banking” (K C Area Credit Union) version 3.0.1. The root cause is the app’s failure to verify X.509 certificates from SSL servers, enabling potential man-in-the-middle attacks to spoof servers and access sensitive informati...

Code injection

Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate...

CVE-2016-5648

The Acer Portal Android app (versions 3.9.3.2003–3.9.3.2006) is affected by CVE-2016-5648 due to improper SSL certificate validation, allowing remote MITM attacks and potential credential exposure when connecting to Acer Cloud. Impact is a credential/theory exposure via unauthenticated, network-b...

CVE-2016-5648: Improper Certificate Validation

Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate...

MoboTap Dolphin Web Browser - Fast Private Internet Search app for iOS Authentication Vulnerability

MoboTap Dolphin Web Browser - Fast Private Internet Search app for iOS is an iOS-based smartphone browser from MoboTap, Inc. An authentication vulnerability exists in the MoboTap Dolphin Web Browser - Fast Private Internet Search app versions 9.23.0 to 9.23.2 for iOS, which stems from the program...

CVE-2017-9045

The CVE-2017-9045 issue affects the Google I/O 2017 Android app (pre-5.1.4). It downloads multiple .json files from http://storage.googleapis.com without SSL, enabling MITM attackers to spoof Feed and Schedule data via a modified blocks_v4.json file. This is described in official CVE/NVD records;...

CVE-2017-8937

The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-8935

Summary: The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted certificate. What’s affected: iOS client of the Indiana Voters app (v...

CVE-2017-8937

The CVE-2017-8937 entry concerns the Life Before Us Yo app for iOS version 2.5.8, where the app does not verify X.509 certificates from SSL servers. This creates a vulnerability that could allow a man‑in‑the‑middle attacker to spoof the server and obtain sensitive information via a crafted certif...

CVE-2017-8943

The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

OnePlus OTA One/X Crossover Vulnerability(CVE-2017-8851)

Products OnePlus X OnePlus One Vulnerable Version All OnePlus OxygenOS & HydrogenOS OTAs Technical Details Due to lenient updater-script on the OnePlus One & X’s OTA images see below, the fact both products use the same OTA verification keys, and the fact both products share the same...

CVE-2017-3212

The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-5906

The CVE-2017-5906 issue affects Everyday Health’s iOS app “Diabetes in Check: Blood Glucose & Carb Tracker” (version 3.4.2). The root cause is failure to validate X.509 certificates from SSL servers, enabling man-in-the-middle attacks to spoof servers and access sensitive information. Connected C...

CVE-2017-5905

The CVE-2017-5905 entry concerns the Dollar Bank Mobile app for iOS (version 2.6.3). The vulnerability is that the app does not verify X.509 certificates from SSL servers, which enables a man-in-the-middle attacker to spoof the legitimate server and obtain sensitive information via a crafted cert...

CVE-2017-3212

CVE-2017-3212 affects the Space Coast Credit Union SCCU Mobile apps: iOS v2.2 and Android v2.1.0.1104, which fail to verify SSL X.509 certificates. This enables MITM attackers to spoof servers and access sensitive information via crafted certificates. Connected sources (NVD, CNVD, CVE listings, C...

CVE-2017-5915

CVE-2017-5915 affects Emirates NBD Bank P.J.S.C Emirates NBD KSA iOS apps (versions UAE 3.10.0–3.10.4 and KSA 2.0.1–2.1.0). The root cause is failure to verify X.509 certificates from SSL servers, enabling a man-in-the-middle attacker to impersonate a trusted server and obtain sensitive informati...

CVE-2017-5902

PayQuicker app 1.0.0 for iOS fails to verify X.509 certificates from SSL servers, due to improper TLS certificate validation in the iOS client. Root cause: insecure certificate handling during TLS handshake, allowing man‑in‑the‑middle attackers to impersonate trusted servers and obtain sensitive ...

CVE-2017-5909

The CVE-2017-5909 entry concerns the Electronic Funds Source Mobile Driver Source app for iOS, version 2.5. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certifica...

CVE-2017-8059

Foxit PDF (iOS) before version 5.4 is vulnerable to accepting invalid/self-signed TLS certificates, enabling a passive or proximity attacker to perform a MITM and silently intercept login credentials (username/password) and an existing authentication token. Root cause: improper TLS certificate va...