CVE-2014-5598

The Puzzle Family (com.com2us.puzzlefamily.up.freefull.google.global.android.common) Android app 1.2.0 is affected by CVE-2014-5598 due to not verifying X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...

CVE-2014-5584

The CVE-2014-5584 entry concerns the Android app BeenVerified (com.beenverified.android) version 4.01.67, where SSL servers are not validating X.509 certificates. This allows a man-in-the-middle to spoof servers and access sensitive data via a crafted certificate. The issue is tied to the app’s T...

CVE-2014-5527

The CVE-2014-5527 entry concerns the Tapjoy library for Android, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as described in multiple connected records. ...

CVE-2014-5524

The Adcolony library for Android does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. This vulnerability (CVE-2014-5524) has a CVSSv2 base score of 5.4 (Medium) with Confidentiality, ...

CVE-2014-5687

The CVE-2014-5687 entry affects the Runtastic Mountain Bike Android app (2.0.1) and is due to the app not verifying X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The issue is documented across multiple sou...

CVE-2014-5547

CVE-2014-5547 affects the Mahjong Galaxy Space Lite app (Android, package air.com.permadi.mahjongIris) version 2.5. The vulnerability is failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted cert...

CVE-2014-5630

The Home Repair Android app (package com.gcspublishing.houserepairtalk) version 3.7.9 does not verify X.509 certificates from SSL servers. This permits man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Root cause: lack of TLS certificate vali...

CVE-2014-5632

The CVE-2014-5632 entry concerns the Android game Mega Jump (package com.getsetgames.megajump). The issue is that the app does not verify X.509 certificates from SSL servers, creating a man-in-the-middle risk where an attacker could spoof TLS endpoints and exfiltrate sensitive information via a c...

CVE-2014-5534

CVE-2014-5534 concerns the Princess Shopping (air.android.PrincessShopping) Android application 2, which does not verify X.509 certificates from SSL servers. This lack of certificate validation can allow man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information thro...

CVE-2014-5690

The Runtastic Timer aka com.runtastic.android.timer application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5537

The Abduction Stacker Free aka air.com.chewygames.abductionstacker2 application 1.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5580

The CVE-2014-5580 entry affects the BackgroundCheckProTool Android app (com.BackgroundCheckProTool) v3.5. The root cause is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...

CVE-2014-5549

Summary: CVE-2014-5549 affects the Android app Puppy Slots Free (air.com.starluxstudios.PuppySlotsFree) v3. The issue is that the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle to spoof servers and harvest sensitive information via a crafted certificate. Wha...

CVE-2014-5596

CVE-2014-5596 affects the Android app Homerun Battle 2 (com.com2us.homerunbattle2.normal.freefull.google.global.android.common) version 1.2.2.0. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which can allow a man-in-the-middle attacker to spo...

CVE-2014-5585

The CVE-2014-5585 entry applies to the Android app “Like4Like: Get Instagram Likes” (package com.bepop.bepop) version 2.1.5. Multiple connected sources confirm the root cause: the app does not verify X.509 certificates when establishing SSL/TLS connections, allowing MITM attackers to spoof server...

CVE-2014-5542

The CVE-2014-5542 entry applies to the Android app The Hidden Object Mystery (air.com.differencegames.hodetectivemysteryfree) v1.0.65, where the app does not verify X.509 SSL certificates. This prevents server authentication, enabling MITM attackers to spoof HTTPS servers and access sensitive dat...

CVE-2014-5554

The Fun Preschool Creativity Game aka air.com.tribalnova.ilearnwith.ipad.MotherAppEn application 1.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5684

The Runtastic Running & Fitness aka com.runtastic.android application 5.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5635

The CVE-2014-5635 entry concerns the Android app Buy Yorkshire Conference (com.gotfocus.buyyorkshire) version 1.4, which fails to verify X.509 certificates from SSL servers. This creates a certificate validation bypass, allowing man-in-the-middle attackers to spoof legitimate servers and extract ...

CVE-2014-5648

CVE-2014-5648 affects the Android app “Chat, Flirt & Dating Heart JAUMO” (com.jaumo) at version 2.7.5. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which enables a man-in-the-middle attacker to spoof servers and exfiltrate sensitive data via...