CVE-2014-7089

CVE-2014-7089 concerns the Android app “COMPETITION INFORMATION (com.ear.bilgiyarismasi)” version 0.1, which does not verify X.509 certificates when establishing SSL connections. This missing certificate validation allows a man-in-the-middle to spoof HTTPS servers and exfiltrate or tamper with se...

CVE-2014-7054

Summary of CVE-2014-7054 : The Android app musica de barrios sonideros (package com.nobexinc.wls_93155702.rc), version 3.3.10, does not verify X.509 certificates when connecting to SSL servers. This allows a man‑in‑the‑middle attacker to spoof servers and obtain sensitive information via a crafte...

APPLE-SA-2014-10-16-6 iTunes 12.0.1

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2014-10-16-6 iTunes 12.0.1 iTunes 12.0.1 is now available and addresses the following: iTunes Available for: Windows 8, Windows 7, Vista, XP SP2 or later Impact: A man-in-the-middle attack while browsing the iTunes Store via iTunes may lead t...

CVE-2014-7036

The Quest Federal CU Mobile aka com.metova.cuae.questfcu application 1.0.27 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7017

The Tim Ban Bon Phuong aka com.entertaiment.timbanbonphuong application 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Esercizi per le donne aka com.rareartifact.eserciziperledonne6D5578C6 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The SudaniNet aka com.sudaninet.wtwqiqbegqbtwlda application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6985

The Georgia Packing aka com.tapatalk.georgiapackingorg application 3.9.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6982

The Arabic Troll Football aka com.hamoosh.ArabicTrollFootball application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6993

The CVE-2014-6993 entry concerns the Codeeta Coupons (com.codeeta.promos) Android app version 1.0.5, which does not verify X.509 SSL certificates. This weakness enables a man‑in‑the‑middle attacker to spoof the server and exfiltrate sensitive information via a crafted certificate. The vulnerabili...

CVE-2014-7045

CVE-2014-7045 affects the Bust Out Bail Android app (package com.onesolutionapps.bustoutbailandroid, version 1.1). The root cause is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a craft...

CVE-2014-7038

The CVE-2014-7038 entry describes a vulnerability in the Al Jazeera Android app (package com.Al.Jazeera.net) version 6.0 where SSL certificate validation is not performed. The underlying issue is failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof ...

CVE-2014-7013

The CVE covers the Android app Funny Photo Color Editor (com.doirdeditor.funcloreditor) version 0.0.4. It fails to verify X.509 certificates from SSL servers, allowing a man‑in‑the‑middle attacker to spoof servers and obtain sensitive information via a crafted certificate. The public descriptions...

CVE-2014-7027

CVE-2014-7027 affects the Android app “Esercizi per le donne” (com.rareartifact.eserciziperledonne6D5578C6) version 1.0. The root cause is that the app does not verify X.509 certificates from SSL servers, enabling potential man-in-the-middle attacks to intercept sensitive information with crafted...

CVE-2014-7018

The CVE-2014-7018 entry concerns the Android app LOVE DANCE (com.efunfun.ddianle.lovedance) version 1.2.0626, which does not verify X.509 certificates from SSL servers. This lack of certificate validation can enable man-in-the-middle attacks to spoof servers and exfiltrate sensitive information v...

CVE-2014-7022

The CVE-2014-7022 entry concerns the Modelisme.com forum/portail Android app (package com.tapatalk.modelismecomforum) version 3.6.9. The root cause is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive infor...

CVE-2014-6971

The Easy Video Downloader aka com.simon.padillar.EasyVideo application 4.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6955

The Le Grand Bleu aka com.appzone468 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6981

The Taiwan Business Bank aka com.mitake.TBB application 2.04 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7040

CVE-2014-7040 affects the UniCredit Investors Android app (version 1.0). The connected sources confirm the root cause: the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and read sensitive information via a crafted certificate. The N...