CVE-2014-6958

The affected software is the ISMRM-ESMRMB 2014 Android app (com.coreapps.android.followme.ismrm_esmrmb14), version 6.0.8.5. The root cause is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive inform...

CVE-2014-7039

CVE-2014-7039 concerns the Wild Women United (com.wildwomenunited) Android app 1.0, which does not verify X.509 certificates from SSL servers. This lack of validation lets a man-in-the-middle spoof a server and capture sensitive information via a crafted certificate. The issue is documented in mu...

CVE-2014-6987

Summary: CVE-2014-6987 affects the Mass Gaming TV Android app (1.0) and is due to the app not verifying X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. The connected records confirm the s...

CVE-2014-7048

The CVE-2014-7048 entry concerns the Android app Bear ID Lock (com.wBearIDLock) , version 0.1. The vulnerability is that the app does not verify X.509 certificates from SSL servers, which allows a man‑in‑the‑middle attacker to spoof servers and obtain sensitive information via a crafted certifica...

CVE-2014-2576

plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle MITM attacks...

CVE-2014-6946

CVE-2014-6946 affects the Android app Re:kyu (aka com.appzone619) 1.0. The root cause is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Public sources in th...

CVE-2014-6947

The Archie Comics aka com.iversecomics.archie.android application 1.07 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6948

CVE-2014-6948 affects the Android app “TH3 professional Al Mohtarif” (com.th3professional.almohtarif) version 1.0. The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle to spoof servers and read sensitive information via a crafted cert...

CVE-2014-6949

The CVE-2014-6949 entry concerns the Android app Akne Ernahrung (package com.rareartifact.akneernahrung72010074) 1.0, which does not verify X.509 certificates from SSL servers. Root cause: missing certificate validation in TLS/SSL, enabling MITM attackers to spoof servers and obtain sensitive inf...

Mozilla Releases Security Updates for Firefox and Thunderbird

The Mozilla Foundation has released security updates to address multiple vulnerabilities in Firefox and Thunderbird. Exploitation of these vulnerabilities may allow an attacker to obtain sensitive information, bypass same-origin policy and key pinning, cause an exploitable crash, conduct a...

[ MDVSA-2014:170 ] jakarta-commons-httpclient

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2014:170 http://www.mandriva.com/en/support/security/ Package : jakarta-commons-httpclient Date : September 2, 2014 Affected: Business Server 1.0 Problem Description: Updated jakarta-commons-httpclient and...

Amazon Linux AMI : openssl098e (ALAS-2014-350)

It was found that OpenSSL clients and servers could be forced, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between a client and a server. CVE-2014-0224 C Tenable Network...

CVE-2014-6940

The Absolute Lending Solutions aka com.soln.S008F6C05EC0B63264B429F6D76286562 application 1.0073.b0073 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6904

The CVE-2014-6904 entry concerns The Safe Browser - The Web Filter (aka com.cloudacl) Android app version 1.2.5. The vulnerability is that it does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. T...

CVE-2014-7046

The George Wassouf aka com.devkhr32.georgewassouf application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

F5 Networks BIG-IP : OpenSSL vulnerability (K15158)

The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service...

F5 Networks BIG-IP : CRIME vulnerability via TLS 1.2 protocol (K14054)

The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data. This allows man-in-the-middle attackers to obtain plain text HTTP headers by observing length differences...

CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

Apache Subversion 1.0.x - 1.7.17 / 1.8.x < 1.8.10 Multiple Vulnerabilities

The version of Subversion Server installed on the remote host is version 1.x.x prior to 1.7.18 or 1.8.x prior to 1.8.10. It is, therefore, affected by the following vulnerabilities : - A flaw exists in the Serf RA layer. This flaw causes wildcards for HTTPS connections to be improperly evaluated,...

CVE-2014-6908

The Forum IC aka com.tapatalk.forumimmigrercom application 3.3.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...