Information disclosure

The psychology aka com.alek.psychology application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5998

CVE-2014-5998 affects SkyDrive Assistant (com.dhh.sky) for Android, version 2.1 . The issue is not verifying X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. CVSSv2 base score is 5.4 (MEDIUM) . N...

CVE-2014-6015

The CVE-2014-6015 entry concerns the TuCarro (com.tucarro) Android app v2.0.5 that does not verify X.509 certificates from SSL servers. This causes potential MITM where an attacker can spoof servers and extract sensitive data via a crafted certificate. Documents confirm the affected software and ...

CVE-2014-6001

CVE-2014-6001 affects the Android gewara (com.gewara) app version 5.2.3, where the code does not verify X.509 certificates from SSL servers. This root cause allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The entry notes a moderate i...

CVE-2014-6005

The CVE-2014-6005 entry affects the Survey.com Mobile app (com.survey.android) for Android, version 3.2.16, which does not verify X.509 certificates from SSL servers, enabling MITM attacks with crafted certificates. CVSSv2 base score is 5.4 (Medium) with adjacent network attack vector, no authent...

CVE-2014-5979

The TV Bengali Open Directory aka com.TVBengali application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Animal Kaiser Zangetsu aka com.wAnimalKaiserZangetsu application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5986

The CVE-2014-5986 entry concerns the Android app Educational Puzzles - Letters (com.EducationalPuzzlesLetters) version 2, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and access sensitive information via a crafted ...

CVE-2014-5987

The CVE-2014-5987 entry concerns the My3 app (com.my3) on Android, which does not verify X.509 certificates when establishing SSL connections. This behavior allows man-in-the-middle attackers to spoof SSL servers and exfiltrate sensitive information via a crafted certificate. The supplied documen...

CVE-2014-5979

CVE-2014-5979 affects the TV Bengali Open Directory (com.TVBengali) Android app version 1.4. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The...

Information disclosure

The BundesArztsuche aka de.kbv.bas application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Dreamland Super Theme GO Gold aka com.gau.go.launcherex.viptheme.dreamland.gold application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5955

The Atomic Fusion aka com.bytesized.fusion application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5925

The CVE-2014-5925 entry concerns the Android app “10000 Kindle Books Downloads” (com.ww10000KindleBooksLatestnBestSellers) version 0.312, which does not verify X.509 certificates from SSL servers. This lack of certificate validation can allow a man-in-the-middle to spoof servers and obtain sensit...

CVE-2014-5934

CVE-2014-5934 affects the Flurv Chat app (com.flurv.android) version 4.3.3 on Android, where SSL/TLS connections do not verify X.509 certificates. This enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected sources corroborat...

CVE-2014-5935

CVE-2014-5935 concerns the Android app “The Daily Free App @ Amazon” (package com.kattanweb.android.dfaa), version 1.5.2. The connected documents state that the client fails to verify X.509 certificates from SSL servers, constituting a failure of certificate validation. The underlying impact is e...

CVE-2014-5943

The CVE-2014-5943 entry concerns LabMSF Antivirus beta (aka com.ReSync.RNGN) 1.0.2 for Android, which fails to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Supported documents confi...

CVE-2014-5936

The CVE-2014-5936 entry concerns the INCOgnito Private Browser (com.SL.InCoBrowser) for Android (version 1.4.0). According to the NVD entry and corroborating records, the app does not verify X.509 certificates from SSL servers, allowing man‑in‑the‑middle attackers to spoof servers and obtain sens...

Code injection

The Secret Circle - talk freely aka com.easyxapp.secret application 2.2.00.26 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5911

The CVE-2014-5911 entry concerns the Android app Free App Icons & Icon Packs (package com.jellytap.cooliconfinder ) version 1.4 , which does not verify X.509 certificates from TLS servers. This enables a man-in-the-middle attacker to spoof servers and obtain sensitive information via a crafted ce...