Information disclosure

The BundesArztsuche aka de.kbv.bas application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Dreamland Super Theme GO Gold aka com.gau.go.launcherex.viptheme.dreamland.gold application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5925

The CVE-2014-5925 entry concerns the Android app “10000 Kindle Books Downloads” (com.ww10000KindleBooksLatestnBestSellers) version 0.312, which does not verify X.509 certificates from SSL servers. This lack of certificate validation can allow a man-in-the-middle to spoof servers and obtain sensit...

CVE-2014-5955

The Atomic Fusion aka com.bytesized.fusion application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5934

CVE-2014-5934 affects the Flurv Chat app (com.flurv.android) version 4.3.3 on Android, where SSL/TLS connections do not verify X.509 certificates. This enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected sources corroborat...

CVE-2014-5936

The CVE-2014-5936 entry concerns the INCOgnito Private Browser (com.SL.InCoBrowser) for Android (version 1.4.0). According to the NVD entry and corroborating records, the app does not verify X.509 certificates from SSL servers, allowing man‑in‑the‑middle attackers to spoof servers and obtain sens...

CVE-2014-5943

The CVE-2014-5943 entry concerns LabMSF Antivirus beta (aka com.ReSync.RNGN) 1.0.2 for Android, which fails to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Supported documents confi...

CVE-2014-5935

CVE-2014-5935 concerns the Android app “The Daily Free App @ Amazon” (package com.kattanweb.android.dfaa), version 1.5.2. The connected documents state that the client fails to verify X.509 certificates from SSL servers, constituting a failure of certificate validation. The underlying impact is e...

Code injection

The Secret Circle - talk freely aka com.easyxapp.secret application 2.2.00.26 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5911

The CVE-2014-5911 entry concerns the Android app Free App Icons & Icon Packs (package com.jellytap.cooliconfinder ) version 1.4 , which does not verify X.509 certificates from TLS servers. This enables a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted ce...

CVE-2014-5913

The CVE-2014-5913 entry concerns The Allies in War (aka com.gamelion.aiw) Android app 1.3.2 failing to verify SSL server X.509 certificates, enabling MITM attackers to spoof servers and obtain sensitive data. Affected component: Android app networking/SSL validation; root cause: lack of certifica...

CVE-2014-5908

The Kmart aka com.kmart.android application @7F0C00EF for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

RHEL 5 / 6 : axis (RHSA-2014:1193)

Updated axis packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2014-5895

The CVE-2014-5895 entry applies to the ShopYourWay Android app (package com.sears.shopyourway) version 1.9. It documents a failure to verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The c...

CVE-2014-5890

The CVE-2014-5890 entry concerns the KBO sports2i 2014 Android app (version 5.1.00). The provided documents confirm that the vulnerability is due to the app failing to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and read sensitive information ...

CVE-2014-5904

The MiniInTheBox Online Shopping aka com.miniinthebox.android application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5893

The froyo aka com.shinsegae.mobile.froyo application 5.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5900

The CVE-2014-5900 entry concerns the myHomework Student Planner Android app (3.0.2; com.myhomeowork). The issue is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Th...

CVE-2014-5904

CVE-2014-5904 describes a vulnerability in the MiniInTheBox Online Shopping Android app (package com.miniinthebox.android) version 2.0.0 where SSL/TLS server certificates are not verified. The root cause is failure to validate X.509 certificates from SSL servers, enabling man-in-the-middle attack...

CVE-2014-5884

The 1&1 Online Storage aka de.einsundeins.smartdrive application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...