Open redirect

The Runtastic Road Bike aka com.runtastic.android.roadbike.lite application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The hasbehaal aka com.anawaz.hasbehaal application 1.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Brightest LED Flashlight aka com.intellectualflame.ledflashlight.washer application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Double free

The Akinator the Genie FREE aka com.digidust.elokence.akinator.freemium application 2.46 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5647

The CVE-2014-5647 entry concerns the ISL Light Remote Desktop Android app (com.islonline.isllight.mobile.android) version 2.1.0, which does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attackers to spoof servers and access sensitive...

CVE-2014-5535

CVE-2014-5535 affects The Baby Get Up - Kids Care (aka air.brown.jordansa.getup) Android app, version 1.0.3. The issue is that the app does not verify X.509 certificates when connecting to SSL servers, enabling potential MITM attackers to spoof servers and access sensitive data via a crafted cert...

CVE-2014-5627

The CVE-2014-5627 entry concerns the Ice Age Village Android app (com.gameloft.android.ANMP.GloftIAHM) version 2.8.0m, where SSL servers are not verified due to missing X.509 certificate verification. This allows a man-in-the-middle to spoof servers and obtain sensitive information via a crafted ...

CVE-2014-5560

The CVE-2014-5560 entry concerns the Android app Popscene (Music Industry Sim) / air.Popscene version 1.04 that fails to verify SSL X.509 certificates. Root cause: missing certificate validation in SSL/TLS connections, which can allow MITM attackers to spoof servers and capture/reveal sensitive i...

CVE-2014-5625

The CVE-2014-5625 issue affects The Perfect Kick app (com.gamegou.PerfectKick.google) on Android 1.3.0, where SSL/TLS servers are not verified due to missing X.509 certificate validation. This enables MITM attackers to spoof servers and exfiltrate sensitive data via crafted certificates. The prov...

CVE-2014-5643

The CVE-2014-5643 entry concerns the Instachat – Instagram Messenger Android app (com.instachat.android), version 1.6.2. Root cause: the app does not verify X.509 certificates from SSL servers. Impact: enables man‑in‑the‑middle attackers to spoof servers and access sensitive information via a cra...

CVE-2014-5598

The Puzzle Family (com.com2us.puzzlefamily.up.freefull.google.global.android.common) Android app 1.2.0 is affected by CVE-2014-5598 due to not verifying X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...

CVE-2014-5668

CVE-2014-5668 affects the BAND - Group sharing & planning (com.nhn.android.band) Android app version 3.2.8. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted c...

CVE-2014-5537

The Abduction Stacker Free aka air.com.chewygames.abductionstacker2 application 1.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5549

Summary: CVE-2014-5549 affects the Android app Puppy Slots Free (air.com.starluxstudios.PuppySlotsFree) v3. The issue is that the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle to spoof servers and harvest sensitive information via a crafted certificate. Wha...

CVE-2014-5687

The CVE-2014-5687 entry affects the Runtastic Mountain Bike Android app (2.0.1) and is due to the app not verifying X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The issue is documented across multiple sou...

CVE-2014-5534

CVE-2014-5534 concerns the Princess Shopping (air.android.PrincessShopping) Android application 2, which does not verify X.509 certificates from SSL servers. This lack of certificate validation can allow man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information thro...

CVE-2014-5585

The CVE-2014-5585 entry applies to the Android app “Like4Like: Get Instagram Likes” (package com.bepop.bepop) version 2.1.5. Multiple connected sources confirm the root cause: the app does not verify X.509 certificates when establishing SSL/TLS connections, allowing MITM attackers to spoof server...

CVE-2014-5630

The Home Repair Android app (package com.gcspublishing.houserepairtalk) version 3.7.9 does not verify X.509 certificates from SSL servers. This permits man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Root cause: lack of TLS certificate vali...

CVE-2014-5596

CVE-2014-5596 affects the Android app Homerun Battle 2 (com.com2us.homerunbattle2.normal.freefull.google.global.android.common) version 1.2.2.0. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which can allow a man-in-the-middle attacker to spo...

CVE-2014-5690

The Runtastic Timer aka com.runtastic.android.timer application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...