CVE-2014-6867

The CVE-2014-6867 entry relates to the Sortir en Alsace (aka com.axessweb.sortirenalsace) Android application version 0.5b, which reportedly does not verify X.509 certificates presented by SSL servers. The underlying issue is a failure to validate certificates, enabling man-in-the-middle attacks ...

CVE-2014-6892

The CVE-2014-6892 entry concerns the kalahari.com Shopping Android app (com.kalahari.shop), version 1.4.2.1. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and potentially obtain sensitive data through c...

Design/Logic Flaw

The New Beginnings CFC aka com.goodbarber.nbcfc application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6855

CVE-2014-6855 concerns the Android app Long (com.imop.longjiang.android) v1.0.4, where the app does not verify X.509 certificates from SSL servers. This behavior enables man-in-the-middle attackers to spoof servers and potentially obtain sensitive information via a crafted certificate. The connec...

CVE-2014-6848

The DS file aka com.synology.DSfile application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6839

The Alma Corinthiana aka com.alma.corinthiana application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Daily Advertiser Print aka com.lafayettedailyadv.android.prod application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6838

The CVE-2014-6838 entry concerns the Groupama Toujours la app (com.groupama.toujoursla) for Android version 1.3.0, where X.509 certificate validation for SSL servers is not performed. This insecure cert handling can allow man-in-the-middle attackers to spoof servers and exfiltrate sensitive infor...

CVE-2014-6847

CVE-2014-6847 corresponds to the Android app Horoscopes and Dreams (com.horoscopesanddreams) version 1.0.1, which does not verify X.509 certificates when making SSL connections. The root cause is missing SSL certificate validation, allowing man-in-the-middle attackers to spoof servers and exfiltr...

CVE-2014-6846

CVE-2014-6846 concerns the Android app “The Four Seasons Beverly Hills” (com.intelitycorp.FourSeasons.android.ice, package @7F050007). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling an attacker in a man‑in‑the‑middle position to spoof servers and o...

CVE-2014-6847

The Horoscopes and Dreams aka com.horoscopesanddreams application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5444

Geary

CVE-2014-6833

The AuctionTrac Dealer aka com.adesa.dealer.phone application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6817

The Cove aka org.covechurch.app application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6820

The Amebra Ameba aka jp.honeytrap15.amebra application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Command injection

The Covet Fashion - Shopping Game aka com.crowdstar.covetfashion application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6836

The DS photo+ aka com.synology.dsphoto application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6815

CVE-2014-6815 affects the Android Vouch! app (com.voucherry.voucherry) version 2.1.6, where SSL certificate validation is not performed. The root cause is failure to verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and access sensitive information ...

CVE-2014-6821

The CVE-2014-6821 entry concerns the Android app voetbal (nl.jborsje.android.voetbal.az) version 4.7.2, where X.509 certificates are not validated by SSL servers. This root cause enables MITM attackers to spoof servers and potentially access sensitive information via a crafted certificate. Docume...

CVE-2014-6829

The Hook aka com.hook.android application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...