CVE-2014-6914

The Houcine El Jasmi aka com.devkhr31.houcineeljasmi application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The diziturky HD 2015 aka com.adv.diziturky application 2014 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Dubrovnik Guided Walking Tours aka com.mytoursapp.android.app351 application 1.3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6921

The CVE-2014-6921 entry affects the Buckhorn Grill (com.orderingapps.buckhorn) Android app version 2.8. It describes a failure to verify X.509 certificates from SSL servers, enabling potential MITM attackers to spoof servers and access sensitive data via a crafted certificate. The NVD entry provi...

CVE-2014-6918

The CVE-2014-6918 entry affects the Android app “The Bikers Underground” (also listed as hr.ap.n66871172), version 4.5.10. The root cause is failure to verify X.509 certificates when connecting to SSL servers, enabling man-in-the-middle attackers to spoof servers and read sensitive data via craft...

CVE-2014-6913

The Dive The World aka com.paperton.wl.divetheworld application 1.53 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6912

The CVE-2014-6912 entry relates to the Android app for The IRA’s 59th Annual Conference (package com.coreapps.android.followme.ira_14), version 6.0.7.6. The connected documents confirm a root cause: the app does not verify X.509 certificates from SSL servers. Impact stated in the sources is that ...

CVE-2014-6907

The CVE-2014-6907 entry covers the Rakuten Install (co.jp.rakuten.installapp) Android app v1.5.0, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. Public ...

CVE-2014-6930

The CVE-2014-6930 issue affects the Android app “The Abram Radio Groove!” (com.nobexinc.wls_79226887.rc) version 3.2.3. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via...

CVE-2014-6917

The CVE-2014-6917 entry concerns the www.knote.kr Smart (aka kr.or.knote.android) Android application (version 1.0.3). The vulnerability is that the app does not verify X.509 certificates presented by SSL servers, enabling man-in-the-middle attackers to spoof servers and capture sensitive data vi...

CVE-2014-6931

CVE-2014-6931 affects the Treves Dance Center Android app (package com.myapphone.android.myapptrvesdancecenter, version 1.0). The flaw is that the app does not verify X.509 SSL certificates, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certi...

CVE-2014-6894

The Lucktastic Android app (com.lucktastic.scratch) version 1.2.6 does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Root cause: missing certificate verification in the app’s SSL/TLS handling. Im...

CVE-2014-6899

CVE-2014-6899 affects the Jazeera Airways Android app (package com.winit.jazeeraairways), version 2.7, where the app does not verify X.509 certificates from SSL servers. This enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate...

CVE-2014-6867

The Sortir en Alsace aka com.axessweb.sortirenalsace application 0.5b for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The WePhone - phone calls vs skype aka com.wephoneapp application 1.03.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Equifax Mobile aka com.equifax application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6882

The CVE-2014-6882 entry concerns the Android app for Western Federal Credit Union (version 2.1), which does not verify X.509 certificates when connecting to SSL servers. This creates a risk of man-in-the-middle attacks, potentially allowing a crafted certificate to spoof the server and expose sen...

CVE-2014-6865

The CVE-2014-6865 entry concerns the Android app The Jamal Bates Show (package com.conduit.app_3a95e13827c54c4da9056fafb33ecc8d.app) version 1.3.14.254. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and...

CVE-2014-6875

CVE-2014-6875 affects the Woodforest Mobile Banking Android app (v3.1); the root cause is that the app does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Exploit status and fixes are not detailed...

CVE-2014-6874

The CVE-2014-6874 issue affects the ModSim Connected (com.concursive.modsim) Android app version 2.0, where the client does not verify X.509 certificates from SSL servers. This weakens authentication and enables MITM attackers to spoof legitimate servers and extract sensitive information via a cr...