CVE-2014-6710

The Chifro Kids Coloring Game aka com.chifro.kidscoloringgame application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6702

The CVE-2014-6702 entry concerns the StarSat International Android app (package com.conduit.app_b15a1814d2d840198e70e3c235af5e8b.app), version 1.41.54.9222, which does not verify X.509 certificates from SSL servers. This implementation flaw allows man-in-the-middle attackers to spoof trusted serv...

CVE-2014-6712

CVE-2014-6712 affects the Airlines International (aka org.iata.IAMagazine) Android app v1.0, where the client fails to verify X.509 SSL certificates. This allows MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The available sources confirm the vulnerabi...

CVE-2014-6708

The CVE-2014-6708 entry concerns the Sporting Club Uphoria (com.sportinginnovations.skc) Android app 2.1.0, which does not verify X.509 certificates from SSL servers. This behavior enables man-in-the-middle attackers to impersonate legitimate servers and extract sensitive data via a crafted certi...

JVN#48270605: Yahoo! Japan Box for Android issue where it fails to verify SSL server certificates

Yahoo! Japan Box for Android provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version...

CVE-2014-6697

The Morocco Weather aka com.mobilesoft.meteomaroc application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The NBA Game Time 2013-2014 aka com.nbadigital.gametimelite application 4.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6701

The CVE-2014-6701 entry concerns the Vendormate Mobile Android app (com.vendormate.mobile) version 3.0. The vulnerability is due to the app not verifying X.509 certificates from SSL servers, enabling potential man-in-the-middle attackers to spoof servers and obtain sensitive information via a cra...

CVE-2014-6699

The Weather Channel (com.weather.Weather) Android app version 5.2.0 does not verify X.509 certificates from SSL servers, allowing man‑in‑the‑middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The provided documents do not specify affected APIs, versions ...

CVE-2014-5323

CVE-2014-5323 affects the Yuko Yuko App for Android (jp.co.yukoyuko.android.yukoyuko_android), version 1.0.5 and earlier. The root cause is that the app does not verify X.509 certificates when establishing SSL connections, enabling potential MITM attackers to spoof servers and access sensitive in...

CVE-2014-5323

The Yuko Yuko aka jp.co.yukoyuko.android.yukoyukoandroid application 1.0.5 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6684

The MOL bringaPONT aka hu.mol.bringapont application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6649

The MyBroadband Tapatalk aka com.tapatalk.mybroadbandcozavb application 3.9.22 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The ElForro.com aka com.tapatalk.elforrocom application 2.4.3.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Latin Angels Music HD aka com.applizards.lafreetj application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Tsushima Travel Guide aka com.netjapan.ntsushima application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The Apploi Job Search- Find Jobs aka com.apploi application 4.19 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6676

The CVE-2014-6676 entry concerns the Android application Exercitii pentru abdomen (com.rareartifact.exercitiipentruabdomen41E29322) version 1.0, where SSL/TLS certificate validation is not performed when connecting to servers. Root cause: lack of X.509 certificate verification enables man-in-the-...

CVE-2014-6684

The CVE-2014-6684 entry concerns the MOL bringaPONT (aka hu.mol.bringapont) Android app version 1.1, which does not verify X.509 certificates from SSL servers. This weakness enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate,...

CVE-2014-6682

The CVE-2014-6682 case is supported by multiple connected records indicating that the Android application com.w88235ff7bdc2fb574f1789750ea99ed6 (package name w88235ff7bdc2fb574f1789750ea99ed6) version 0.1 fails to verify X.509 certificates when connecting to SSL servers. Root cause: missing certi...