CVE-2014-5555

The Counting & Addition Kids Games aka air.com.tribalnova.ilearnwith.ipad.PokoAddEn application 1.8.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5591

The Frankly Chat aka com.chatfrankly.android application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5600

The familyconnect aka com.comcast.plaxo.familyconnect.app application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5623

The penguinchefshop aka com.freegames.penguinchefshop application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5622

The Follow Mania for Instagram aka com.followmania application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5615

CVE-2014-5615 affects the Snap Secure app (com.exclaim.snapsecure.app) version 9.5 for Android, where SSL/TLS certificate verification is not performed. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. The vulnerability details ar...

CVE-2014-5545

The CVE-2014-5545 entry documents a vulnerability in the Sprint jump (aka air.com.ilaz.appilas) Android app, where the application does not verify X.509 certificates from SSL servers. The underlying issue is missing certificate validation, which allows a man-in-the-middle attacker to spoof server...

CVE-2014-5662

CVE-2014-5662 affects the Android app Rail Rush (com.miniclip.railrush) version 1.9.0. The vulnerability is due to the app not performing X.509 certificate validation for SSL servers, which enables man-in-the-middle attackers to spoof trusted servers and exfiltrate sensitive information via a cra...

CVE-2014-5611

The CVE-2014-5611 entry concerns the Android app com.ebay.kleinanzeigen (Germany) version 5.0.2, which does not verify X.509 certificates from SSL servers. This creates a risk of MITM disclosure of sensitive information via crafted certificates. The available connected documents corroborate that ...

PT-2014-6772

Name of the Vulnerable Software and Affected Versions The Ninja Chicken application version 1.7.6 Description The issue concerns the application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

PT-2014-6808

Name of the Vulnerable Software and Affected Versions The Cleaner - Speed up & Clean aka com.liquidum.thecleaner version 1.4.2 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not veri...

PT-2014-6719

Name of the Vulnerable Software and Affected Versions The Buy Books aka com.wBooksForSale application version 0.1 Description The issue concerns the application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-6661

Name of the Vulnerable Software and Affected Versions The Township aka com.playrix.township version 1.5.1 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

PT-2014-6514

Name of the Vulnerable Software and Affected Versions Appsflyer library for Android affected versions not specified Description The issue concerns the Appsflyer library for Android, which fails to verify X.509 certificates from SSL servers. This oversight allows man-in-the-middle attackers to spo...

PT-2014-6569

Name of the Vulnerable Software and Affected Versions BeenVerified application version 4.01.67 Description The issue concerns the BeenVerified application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-6657

Name of the Vulnerable Software and Affected Versions NQ Mobile Security & Antivirus version 7.2.16.00 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from S...

PT-2014-6710

Name of the Vulnerable Software and Affected Versions Truecaller - Caller ID & Block aka com.truecaller version 4.32 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

jakarta-commons-httpclient security update

1:3.1-16 - Fix MITM security vulnerability - Resolves: CVE-2014-3577...

New Firefox 32 Adds Protection Against MiTM Attack and Rogue Certificates

Good news for Firefox lovers! The Mozilla Foundation has introduced a bunch of new features in Firefox to improve browser security with the launch of Firefox 32, now available for Windows, Mac, Linux, and Android platforms. The new version of Firefox makes the browser even more competitive among...