CVE-2014-6976

CVE-2014-6976 affects the Android app Aeroexpress (aka ru.lynx.aero) version 2.6.2. The root cause is that the application does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The vulnerability im...

CVE-2014-6968

CVE-2014-6968 affects the Android app Grandma’s Grotto (com.mobileappsuite.grandmasgrotto) version 1. The root cause is the app not verifying X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The ...

OpenSSL Releases Patch for POODLE Attack

The OpenSSL Project has released a new version of the encryption software, which patches several security flaws, including the bug that is exploited by the POODLE attack on SSLv3. The updated versions of OpenSSL come just a couple of days after a trio of researchers at Google revealed the POODLE...

PT-2014-7712

Name of the Vulnerable Software and Affected Versions The Noble Sticker "FREE" aka com.kuronecostudio.kizokustamp.free version 1.0.7 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-7696

Name of the Vulnerable Software and Affected Versions The Leg Surgery - Kids Games aka com.harriskerioe.legsurgery version 1.0.2 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information...

PT-2014-7640

Name of the Vulnerable Software and Affected Versions Hanyang University Admissions aka kr.ac.hanyang.planner version 2.1.3 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

PT-2014-7632

Name of the Vulnerable Software and Affected Versions Hydrogen Water aka com.appzone628 version 1.0 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Important: nss

Issue Overview: A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. This flaw allows a man-in-the-middle MITM attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are abl...

PT-2014-7672

Name of the Vulnerable Software and Affected Versions The Martial Arts Battle Card aka com.tapenjoy.zjh.tw version 1.0.9 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

openssl security update

1.0.1e-30.2 - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 1.0.1e-30 - add ECC TLS extensions to DTLS 1119800 1.0.1e-29 - fix CVE-2014-3505...

CVE-2014-2576

plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle MITM attacks...

CVE-2014-2576

plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle MITM attacks...

CVE-2014-2576

plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle MITM attacks...

CVE-2014-2576

This CVE concerns Claws Mail’s RSSYL integration: plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN/SAN host names, enabling easier server spoofing and MITM attacks. The vulnerability affects the SSL/TLS hostname verification path and can impact con...

CVE-2014-6946

The Re:kyu aka com.appzone619 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Konigsleiten aka com.knigsleiten application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6951

The OneFile Ignite (uk.co.onefile.ignite) Android app, version 1.19, does not verify X.509 certificates from SSL servers, per CVE-2014-6951. This leads to MITM possible to spoof servers and exfiltrate data. Public records (NVD, CVE listings) confirm the vulnerability and its impact (partial confi...

CVE-2014-6946

The Re:kyu aka com.appzone619 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

SSLv3 Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE)

The remote host is affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. MitM attackers can decrypt a...

CVE-2014-2576: Undefined Security Weakness

plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle MITM attacks...