Information disclosure

The Well-Being Connect Mobile aka com.healthways.wellbeinggo application 2.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6738

The Maccabi Tel Aviv aka com.monkeytech.maccabi application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6734

The CVE-2014-6734 entry concerns the Android app Wine Making (com.gcspublishing.winemakingtalk) version 3.7.15. The vulnerability is a failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...

CVE-2014-6736

The EPL Hat Trick aka com.hat.trick.goal application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6739

CVE-2014-6739 relates to the Android app Well-Being Connect Mobile (com.healthways.wellbeinggo) 2.9, where the app does not verify X.509 certificates from SSL servers. This creates a man‑in‑the‑middle risk, allowing an attacker to spoof servers and obtain sensitive information via a crafted certi...

CVE-2014-6746

The Infiniti Roadside Assistance aka com.ccas.rsa.common.infiniti application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6737

The CVE-2014-6737 entry concerns the Android app “The Ultimate Target-Armored Sniper” (aka air.wood.liame.ultimatetarget), version 1.0.1. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, enabling MITM attackers to spoof servers and exfiltrate se...

CVE-2014-6732

The Westpac Mobile Banking aka org.westpac.bank application 5.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6727

The Mikeius Official App aka com.automon.mikeius application 1.4.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6710

The Chifro Kids Coloring Game aka com.chifro.kidscoloringgame application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6702

The CVE-2014-6702 entry concerns the StarSat International Android app (package com.conduit.app_b15a1814d2d840198e70e3c235af5e8b.app), version 1.41.54.9222, which does not verify X.509 certificates from SSL servers. This implementation flaw allows man-in-the-middle attackers to spoof trusted serv...

CVE-2014-6708

The CVE-2014-6708 entry concerns the Sporting Club Uphoria (com.sportinginnovations.skc) Android app 2.1.0, which does not verify X.509 certificates from SSL servers. This behavior enables man-in-the-middle attackers to impersonate legitimate servers and extract sensitive data via a crafted certi...

CVE-2014-6712

CVE-2014-6712 affects the Airlines International (aka org.iata.IAMagazine) Android app v1.0, where the client fails to verify X.509 SSL certificates. This allows MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The available sources confirm the vulnerabi...

JVN#48270605: Yahoo! Japan Box for Android issue where it fails to verify SSL server certificates

Yahoo! Japan Box for Android provided by Yahoo Japan Corporation contains an issue where it fails to verify SSL server certificates. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the Software Update to the latest version...

CVE-2014-6697

The Morocco Weather aka com.mobilesoft.meteomaroc application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The NBA Game Time 2013-2014 aka com.nbadigital.gametimelite application 4.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6701

The CVE-2014-6701 entry concerns the Vendormate Mobile Android app (com.vendormate.mobile) version 3.0. The vulnerability is due to the app not verifying X.509 certificates from SSL servers, enabling potential man-in-the-middle attackers to spoof servers and obtain sensitive information via a cra...

CVE-2014-6699

The Weather Channel (com.weather.Weather) Android app version 5.2.0 does not verify X.509 certificates from SSL servers, allowing man‑in‑the‑middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The provided documents do not specify affected APIs, versions ...

CVE-2014-5323

CVE-2014-5323 affects the Yuko Yuko App for Android (jp.co.yukoyuko.android.yukoyuko_android), version 1.0.5 and earlier. The root cause is that the app does not verify X.509 certificates when establishing SSL connections, enabling potential MITM attackers to spoof servers and access sensitive in...

Ubuntu 14.04 LTS : APT vulnerability (USN-2353-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2353-1 advisory. It was discovered that APT incorrectly handled certain http URLs. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be...