CVE-2014-6832

CVE-2014-6832 affects the Android app The Bersa Forum (package com.gcspublishing.bersaforum) version 3.9.16. The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and potentially obtain sensitive information via a crafted c...

CVE-2014-6826

The CVE-2014-6826 entry affects the Android app Tic-Tac To The MAX FREE (package com.tothemax) version 1.2, which does not verify X.509 certificates from SSL servers. Root cause: improper TLS certificate validation, enabling a man-in-the-middle to spoof servers and access sensitive information vi...

PYSEC-2014-115

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update

An update for Red Hat JBoss Enterprise Application Platform 5.2.0 that fixes two security issues is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

CVE-2014-6784

The Fermononrespiri Mobile aka com.tapatalk.rmonlineitforums application 3.8.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Cross site request forgery (csrf)

The frank matano aka com.frank.matano application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The CIH Quiz game aka com.bowenehs.cihquizgameapp application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6804

The Deschutes Public MobileLibrary aka com.bredir.boopsie.deschutes application 4.5.110 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6775

The CVE-2014-6775 entry affects the Android app Light for Pets (com.helenwoodward.light4pets) v1.0, where SSL certificate validation is not performed. This causes potential MITM exploitation to spoof servers and exfiltrate sensitive information via a crafted certificate. Root cause: missing X.509...

CVE-2014-6781

CVE-2014-6781 concerns the Aloha Stadium - Hawaii Android app (package com.stadium.aloha), version 1.2. The vulnerability is that the app does not verify X.509 certificates from SSL servers, which can allow a man-in-the-middle to spoof servers and obtain sensitive information via a crafted certif...

CVE-2014-6793

The CVE-2014-6793 entry concerns the Android app The Arch Friend (com.xyproto.archfriend) version 0.4.2. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and exfiltrate sensitive data via a crafted certifi...

CVE-2014-6789

The Anaheim Library 2Go! aka com.bredir.boopsie.anaheim application 4.5.110 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6796

The CVE-2014-6796 entry concerns the Android LocalSense (com.LocalSense) app v1.2.1, which does not verify X.509 certificates from SSL servers. This improper TLS validation enables man-in-the-middle attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. The aff...

CVE-2014-6801

CVE-2014-6801 affects the Android app “frank matano” (version 1.0). The root cause is failure to verify X.509 certificates from SSL servers, which enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Public data from NVD lists a CVSS v2 ...

CVE-2014-6787

CVE-2014-6787 affects the Counter Intuition (com.counter.intuition) Android app version 1.2. The vulnerability is that the app does not verify X.509 certificates from SSL servers, which can allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica...

Information disclosure

The Aerospace Jobs aka com.appaerospacejobs.layout application 1.399 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6770

The Aerospace Jobs aka com.appaerospacejobs.layout application 1.399 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6758

The Qin Story aka com.kongzhong.tjmammoth.android.cqqslengp application 1.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6751

The CVE-2014-6751 entry covers the Grasshopper Beta (com.grasshopper.dialer) Android app version 2.1, which does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attacks to spoof servers and exfiltrate sensitive information. The NVD rep...

CVE-2014-6736

The EPL Hat Trick aka com.hat.trick.goal application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...