CVE-2014-6659

The CVE-2014-6659 entry concerns the Android Defence.pk (com.tapatalk.defencepkforums) app, version 2.4.13.1, which does not verify X.509 certificates when connecting to SSL servers. The underlying issue is the app’s failure to validate server certificates, enabling man-in-the-middle attackers to...

CVE-2014-6650

The NextGenUpdate aka com.tapatalk.nextgenupdatecomforums application 3.1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7354

Name of the Vulnerable Software and Affected Versions Exercitii pentru abdomen aka com.rareartifact.exercitiipentruabdomen41E29322 version 1.0 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitiv...

PT-2014-7342

Name of the Vulnerable Software and Affected Versions The Latin Angels Music HD aka com.applizards.lafreetj version 2.0 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

IBM Domino 9.0.x < 9.0.1 Fix Pack 2 Multiple Vulnerabilities (credentialed check) (POODLE)

The version of IBM Domino formerly Lotus Domino installed on the remote host is 9.0.x prior to 9.0.1 Fix Pack 2 FP2. It is, therefore, affected by the following vulnerabilities : - An unspecified error exists related to the TLS implementation and the IBM HTTP server that could allow certain error...

Information disclosure

The FIAT Forum aka com.tapatalk.fiatforumcom application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Gravity Bounce aka net.toddm.gb application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6016

The Celluloid aka com.eurisko.celluloid application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6016

The CVE-2014-6016 entry concerns the Celluloid (com.eurisko.celluloid) Android app version 1.3, which does not verify X.509 certificates from SSL servers. This allows a man-in-the-middle attacker to spoof SSL servers and obtain sensitive information via a crafted certificate. The vulnerability is...

CVE-2014-6000

The FreshDirect aka com.freshdirect.android application 2.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5809

The Smart Browser aka smartbrowser.geniuscloud application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5981

CVE-2014-5981 affects the MoWeather Android app (com.moji.moweather) 1.40.05. Root cause: SSL X.509 certificate validation is not performed, enabling man‑in‑the‑middle with crafted certificates to obtain sensitive information. Exploit details or remediation/version patch information are not provi...

PT-2014-6957

Name of the Vulnerable Software and Affected Versions The Loving - Couple Essential aka com.xiaoenai.app version 4.0.1 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

CVE-2014-5946

The forumhawaaworldcom aka com.tapatalk.forumhawaaworldcom application 3.4.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Flurv Chat aka com.flurv.android application 4.3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5940

The CVE-2014-5940 entry concerns the PocketPC.ch (com.tapatalk.pocketpcch) Android app v3.9.51 that does not verify X.509 certificates from SSL servers. This underlying flaw enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate....

CVE-2014-5919

The SurDoc - 100GB+ FREE storage aka com.jd.surdoc application 1.3.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Important: axis

Issue Overview: It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name CN field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. CVE-2014-3596 Affected Packages: axis Issu...

Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

CVE-2014-5899

The CVE-2014-5899 entry concerns the Nespresso Android app (com.nespresso.activities) version 2.4.1. The root cause is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates....