CVE-2014-5622

The Follow Mania for Instagram aka com.followmania application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5582

The Ingress Intel Helper aka com.bb.ingressintel application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5543

The Hidden Object - Alice Free aka air.com.differencegames.hovisionsofalicefree application 1.0.17 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5534

The Princess Shopping aka air.android.PrincessShopping application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5529

The Gameloft library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The PopU 2: Get Likes on Instagram aka com.popuapp.popu application 1.7.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Huntington Mobile aka com.huntington.m application 2.1.222 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Piano Teacher aka com.rubycell.pianisthd application 20140730 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Kiss Kiss Office aka com.girlsgames123.kisskissoffice application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Open redirect

The Runtastic Road Bike aka com.runtastic.android.roadbike.lite application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Brightest LED Flashlight aka com.intellectualflame.ledflashlight.washer application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Double free

The Akinator the Genie FREE aka com.digidust.elokence.akinator.freemium application 2.46 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The hasbehaal aka com.anawaz.hasbehaal application 1.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5643

The CVE-2014-5643 entry concerns the Instachat – Instagram Messenger Android app (com.instachat.android), version 1.6.2. Root cause: the app does not verify X.509 certificates from SSL servers. Impact: enables man‑in‑the‑middle attackers to spoof servers and access sensitive information via a cra...

CVE-2014-5647

The CVE-2014-5647 entry concerns the ISL Light Remote Desktop Android app (com.islonline.isllight.mobile.android) version 2.1.0, which does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attackers to spoof servers and access sensitive...

CVE-2014-5560

The CVE-2014-5560 entry concerns the Android app Popscene (Music Industry Sim) / air.Popscene version 1.04 that fails to verify SSL X.509 certificates. Root cause: missing certificate validation in SSL/TLS connections, which can allow MITM attackers to spoof servers and capture/reveal sensitive i...

CVE-2014-5627

The CVE-2014-5627 entry concerns the Ice Age Village Android app (com.gameloft.android.ANMP.GloftIAHM) version 2.8.0m, where SSL servers are not verified due to missing X.509 certificate verification. This allows a man-in-the-middle to spoof servers and obtain sensitive information via a crafted ...

CVE-2014-5535

CVE-2014-5535 affects The Baby Get Up - Kids Care (aka air.brown.jordansa.getup) Android app, version 1.0.3. The issue is that the app does not verify X.509 certificates when connecting to SSL servers, enabling potential MITM attackers to spoof servers and access sensitive data via a crafted cert...

CVE-2014-5668

CVE-2014-5668 affects the BAND - Group sharing & planning (com.nhn.android.band) Android app version 3.2.8. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted c...

CVE-2014-5625

The CVE-2014-5625 issue affects The Perfect Kick app (com.gamegou.PerfectKick.google) on Android 1.3.0, where SSL/TLS servers are not verified due to missing X.509 certificate validation. This enables MITM attackers to spoof servers and exfiltrate sensitive data via crafted certificates. The prov...