CVE-2014-6859

The CVE-2014-6859 entry applies to Daum Maps - Subway (net.daum.android.map) 3.9.1 on Android, where the app does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attackers to spoof servers and access sensitive information via a crafted...

CVE-2014-6886

The CVE-2014-6886 entry relates to the WePhone Android app (version 1.03.00) failing to verify X.509 certificates from SSL servers, enabling MITM disclosure. Evidence in connected sources indicates this is a certificate-validation flaw in the client that can expose partial confidentiality/integri...

CVE-2014-6866

The HomeAdvisor Mobile aka com.servicemagic.consumer application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6871

The CVE-2014-6871 entry concerns the Android app Hogs Fly Crazy (com.pedrojayme.hogsflycrazy) version 1.0.0, which does not verify X.509 certificates from SSL servers. This configuration flaw allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...

CVE-2014-6889

The CVE-2014-6889 entry concerns the GunBroker.com Android app (com.gunbroker.android) version 1.1.2, where SSL/TLS connections do not verify X.509 certificates. This weak certificate validation enables man-in-the-middle attackers to spoof servers and potentially obtain sensitive information via ...

CVE-2014-6865

The Jamal Bates Show aka com.conduit.app3a95e13827c54c4da9056fafb33ecc8d.app application 1.3.14.254 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6885

The CVE-2014-6885 vulnerability affects the Academy Sports + Outdoors Visa Android app (package com.usbank.icsmobile.academysports) version 1.18, where SSL servers’ X.509 certificates are not verified. This underpins a man-in-the-middle risk, allowing an attacker to spoof servers and access sensi...

CVE-2014-6868

Affected software & description: DS audio (com.synology.DSaudio) Android app, version 3.4. Vulnerability: the app does not verify X.509 certificates from TLS/SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Impact & con...

CVE-2014-6892

The CVE-2014-6892 entry concerns the kalahari.com Shopping Android app (com.kalahari.shop), version 1.4.2.1. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and potentially obtain sensitive data through c...

CVE-2014-6863

The CVE-2014-6863 entry affects the Android app Mootorratturid & biker.ee (aka ee.digitalfruit.mootorratturid) version 1.0. The vulnerability is that the application does not verify X.509 certificates from SSL servers, enabling potential man-in-the-middle attackers to spoof servers and capture se...

CVE-2014-6869

The affected software is the Android barcode scanner app (tw.com.books.android.plus) version 2.3.0. The root cause is that it does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. This...

CVE-2014-6867

The CVE-2014-6867 entry relates to the Sortir en Alsace (aka com.axessweb.sortirenalsace) Android application version 0.5b, which reportedly does not verify X.509 certificates presented by SSL servers. The underlying issue is a failure to validate certificates, enabling man-in-the-middle attacks ...

Design/Logic Flaw

The New Beginnings CFC aka com.goodbarber.nbcfc application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6855

CVE-2014-6855 concerns the Android app Long (com.imop.longjiang.android) v1.0.4, where the app does not verify X.509 certificates from SSL servers. This behavior enables man-in-the-middle attackers to spoof servers and potentially obtain sensitive information via a crafted certificate. The connec...

CVE-2014-6848

The DS file aka com.synology.DSfile application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6839

The Alma Corinthiana aka com.alma.corinthiana application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Daily Advertiser Print aka com.lafayettedailyadv.android.prod application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6838

The CVE-2014-6838 entry concerns the Groupama Toujours la app (com.groupama.toujoursla) for Android version 1.3.0, where X.509 certificate validation for SSL servers is not performed. This insecure cert handling can allow man-in-the-middle attackers to spoof servers and exfiltrate sensitive infor...

CVE-2014-6847

CVE-2014-6847 corresponds to the Android app Horoscopes and Dreams (com.horoscopesanddreams) version 1.0.1, which does not verify X.509 certificates when making SSL connections. The root cause is missing SSL certificate validation, allowing man-in-the-middle attackers to spoof servers and exfiltr...

CVE-2014-6846

CVE-2014-6846 concerns the Android app “The Four Seasons Beverly Hills” (com.intelitycorp.FourSeasons.android.ice, package @7F050007). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling an attacker in a man‑in‑the‑middle position to spoof servers and o...