CVE-2014-5913

The CVE-2014-5913 entry concerns The Allies in War (aka com.gamelion.aiw) Android app 1.3.2 failing to verify SSL server X.509 certificates, enabling MITM attackers to spoof servers and obtain sensitive data. Affected component: Android app networking/SSL validation; root cause: lack of certifica...

CVE-2014-5908

The Kmart aka com.kmart.android application @7F0C00EF for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

RHEL 5 / 6 : axis (RHSA-2014:1193)

Updated axis packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

CVE-2014-5895

The CVE-2014-5895 entry applies to the ShopYourWay Android app (package com.sears.shopyourway) version 1.9. It documents a failure to verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The c...

CVE-2014-5890

The CVE-2014-5890 entry concerns the KBO sports2i 2014 Android app (version 5.1.00). The provided documents confirm that the vulnerability is due to the app failing to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and read sensitive information ...

CVE-2014-5904

The MiniInTheBox Online Shopping aka com.miniinthebox.android application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5893

The froyo aka com.shinsegae.mobile.froyo application 5.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5904

CVE-2014-5904 describes a vulnerability in the MiniInTheBox Online Shopping Android app (package com.miniinthebox.android) version 2.0.0 where SSL/TLS server certificates are not verified. The root cause is failure to validate X.509 certificates from SSL servers, enabling man-in-the-middle attack...

CVE-2014-5900

The CVE-2014-5900 entry concerns the myHomework Student Planner Android app (3.0.2; com.myhomeowork). The issue is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Th...

CVE-2014-5884

The 1&1 Online Storage aka de.einsundeins.smartdrive application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5887

The Yell Local Search aka com.yell.launcher2 application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5883

The CVE-2014-5883 entry concerns the 7-ELEVEN Android app version 2.08.000 that does not verify X.509 certificates from SSL servers. Root cause: missing certificate verification enables MITM attackers to spoof servers and access sensitive information via crafted certificates. Documented impact is...

CVE-2014-5888

The CVE-2014-5888 entry concerns the Android app “SLOTS: Bible Slots Free” (package com.topfreegames.topbibleslots) version 1.122. The underlying issue is that the app does not verify X.509 SSL certificates, allowing a man-in-the-middle to spoof servers and obtain sensitive information via a craf...

Mandriva Linux Security Advisory : jakarta-commons-httpclient (MDVSA-2014:170)

Updated jakarta-commons-httpclient and httpcomponents-client packages fix security vulnerability : The Jakarta Commons HttpClient and Apache httpcomponents HttpClient components may be susceptible to a 'Man in the Middle Attack' due to a flaw in the default hostname verification during SSL/TLS wh...

CVE-2014-5879

The tvguide aka kenneth.tvguide application 1.9.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Sylphone aka com.sylpheo.prospectosyl application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5878

The ium (net.ium.mobile.android) Android app, version 3.3.4, does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via crafted certificates. Affected component is the TLS certificate validation logic; root cause is lack of s...

CVE-2014-5870

The CVE-2014-5870 entry concerns the Kmart (com.kmart.android) Android app version 6.2.8. The connected documents confirm that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certific...

CVE-2014-5877

The TV Guide aka net.micene.minigroup.palimpsests.lite application 5.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-0351

Fortinet FortiOS versions affected: FortiOS before 4.3.16 and 5.x before 5.0.8. The FortiManager service allows anonymous cipher suites, enabling a man‑in‑the‑middle to read or tamper traffic. According to FG-IR-14-006, this vulnerability (CVE-2014-0351) can also impact FortiManager communication...