CVE-2014-6917

The CVE-2014-6917 entry concerns the www.knote.kr Smart (aka kr.or.knote.android) Android application (version 1.0.3). The vulnerability is that the app does not verify X.509 certificates presented by SSL servers, enabling man-in-the-middle attackers to spoof servers and capture sensitive data vi...

CVE-2014-6894

The Lucktastic Android app (com.lucktastic.scratch) version 1.2.6 does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Root cause: missing certificate verification in the app’s SSL/TLS handling. Im...

CVE-2014-6899

CVE-2014-6899 affects the Jazeera Airways Android app (package com.winit.jazeeraairways), version 2.7, where the app does not verify X.509 certificates from SSL servers. This enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate...

CVE-2014-6867

The Sortir en Alsace aka com.axessweb.sortirenalsace application 0.5b for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The WePhone - phone calls vs skype aka com.wephoneapp application 1.03.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Equifax Mobile aka com.equifax application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6882

The CVE-2014-6882 entry concerns the Android app for Western Federal Credit Union (version 2.1), which does not verify X.509 certificates when connecting to SSL servers. This creates a risk of man-in-the-middle attacks, potentially allowing a crafted certificate to spoof the server and expose sen...

CVE-2014-6875

CVE-2014-6875 affects the Woodforest Mobile Banking Android app (v3.1); the root cause is that the app does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Exploit status and fixes are not detailed...

CVE-2014-6874

The CVE-2014-6874 issue affects the ModSim Connected (com.concursive.modsim) Android app version 2.0, where the client does not verify X.509 certificates from SSL servers. This weakens authentication and enables MITM attackers to spoof legitimate servers and extract sensitive information via a cr...

CVE-2014-6865

The CVE-2014-6865 entry concerns the Android app The Jamal Bates Show (package com.conduit.app_3a95e13827c54c4da9056fafb33ecc8d.app) version 1.3.14.254. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and...

CVE-2014-6886

The CVE-2014-6886 entry relates to the WePhone Android app (version 1.03.00) failing to verify X.509 certificates from SSL servers, enabling MITM disclosure. Evidence in connected sources indicates this is a certificate-validation flaw in the client that can expose partial confidentiality/integri...

CVE-2014-6859

The CVE-2014-6859 entry applies to Daum Maps - Subway (net.daum.android.map) 3.9.1 on Android, where the app does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attackers to spoof servers and access sensitive information via a crafted...

CVE-2014-6871

The CVE-2014-6871 entry concerns the Android app Hogs Fly Crazy (com.pedrojayme.hogsflycrazy) version 1.0.0, which does not verify X.509 certificates from SSL servers. This configuration flaw allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...

CVE-2014-6866

The HomeAdvisor Mobile aka com.servicemagic.consumer application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6889

The CVE-2014-6889 entry concerns the GunBroker.com Android app (com.gunbroker.android) version 1.1.2, where SSL/TLS connections do not verify X.509 certificates. This weak certificate validation enables man-in-the-middle attackers to spoof servers and potentially obtain sensitive information via ...

CVE-2014-6868

Affected software & description: DS audio (com.synology.DSaudio) Android app, version 3.4. Vulnerability: the app does not verify X.509 certificates from TLS/SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Impact & con...

CVE-2014-6885

The CVE-2014-6885 vulnerability affects the Academy Sports + Outdoors Visa Android app (package com.usbank.icsmobile.academysports) version 1.18, where SSL servers’ X.509 certificates are not verified. This underpins a man-in-the-middle risk, allowing an attacker to spoof servers and access sensi...

CVE-2014-6865

The Jamal Bates Show aka com.conduit.app3a95e13827c54c4da9056fafb33ecc8d.app application 1.3.14.254 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6863

The CVE-2014-6863 entry affects the Android app Mootorratturid & biker.ee (aka ee.digitalfruit.mootorratturid) version 1.0. The vulnerability is that the application does not verify X.509 certificates from SSL servers, enabling potential man-in-the-middle attackers to spoof servers and capture se...

CVE-2014-6869

The affected software is the Android barcode scanner app (tw.com.books.android.plus) version 2.3.0. The root cause is that it does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. This...