CVE-2014-5596

CVE-2014-5596 affects the Android app Homerun Battle 2 (com.com2us.homerunbattle2.normal.freefull.google.global.android.common) version 1.2.2.0. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which can allow a man-in-the-middle attacker to spo...

CVE-2014-5527

The CVE-2014-5527 entry concerns the Tapjoy library for Android, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as described in multiple connected records. ...

CVE-2014-5584

The CVE-2014-5584 entry concerns the Android app BeenVerified (com.beenverified.android) version 4.01.67, where SSL servers are not validating X.509 certificates. This allows a man-in-the-middle to spoof servers and access sensitive data via a crafted certificate. The issue is tied to the app’s T...

CVE-2014-5524

The Adcolony library for Android does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. This vulnerability (CVE-2014-5524) has a CVSSv2 base score of 5.4 (Medium) with Confidentiality, ...

CVE-2014-5632

The CVE-2014-5632 entry concerns the Android game Mega Jump (package com.getsetgames.megajump). The issue is that the app does not verify X.509 certificates from SSL servers, creating a man-in-the-middle risk where an attacker could spoof TLS endpoints and exfiltrate sensitive information via a c...

CVE-2014-5580

The CVE-2014-5580 entry affects the BackgroundCheckProTool Android app (com.BackgroundCheckProTool) v3.5. The root cause is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...

CVE-2014-5679

The CVE ties to the Android app PopU 2: Get Likes on Instagram (package: com.popuapp.popu) version 1.7.5 . The vulnerability is that the app does not verify X.509 certificates from SSL servers , enabling potential man-in-the-middle attackers to spoof servers and access sensitive information via a...

CVE-2014-5684

The Runtastic Running & Fitness aka com.runtastic.android application 5.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5635

The CVE-2014-5635 entry concerns the Android app Buy Yorkshire Conference (com.gotfocus.buyyorkshire) version 1.4, which fails to verify X.509 certificates from SSL servers. This creates a certificate validation bypass, allowing man-in-the-middle attackers to spoof legitimate servers and extract ...

CVE-2014-5648

CVE-2014-5648 affects the Android app “Chat, Flirt & Dating Heart JAUMO” (com.jaumo) at version 2.7.5. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which enables a man-in-the-middle attacker to spoof servers and exfiltrate sensitive data via...

CVE-2014-5641

CVE-2014-5641 affects the Cloud Manager (com.ileaf.cloud_manager) Android app v1.6. The vulnerability is due to failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive data via a crafted certificate. Documented impact is ex...

CVE-2014-5542

The CVE-2014-5542 entry applies to the Android app The Hidden Object Mystery (air.com.differencegames.hodetectivemysteryfree) v1.0.65, where the app does not verify X.509 SSL certificates. This prevents server authentication, enabling MITM attackers to spoof HTTPS servers and access sensitive dat...

CVE-2014-5554

The Fun Preschool Creativity Game aka air.com.tribalnova.ilearnwith.ipad.MotherAppEn application 1.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5591

The CVE-2014-5591 entry applies to the Frankly Chat (com.chatfrankly.android) app version 3.0.1 on Android, where TLS/SSL certificate verification is not performed, enabling MITM attackers to spoof servers and access sensitive data via a crafted certificate. Root cause: the app does not verify X....

Chinese Government Accused of Intercepting Traffic Between Google and CERNET

So far, we all are well aware of the fact that Chinese have had a past filled with cases of Cyber Crime. China is the world’s largest exporter of IT goods, but it has been criticized by many countries due to suspected backdoors in its products, including United States which has banned its several...

CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

Fake Cell Phone Towers Could Be Intercepting Your Calls

A notable number of cell phone towers around the United States are rogue that, according to latest report, could spoof legitimate towers and intercept calls. The research carried out by ESD America, a defense and law enforcement technology firm based in Las Vegas, shows that a rogue cell phone...

CentOS 7 : httpcomponents-client (CESA-2014:1146)

Updated httpcomponents-client packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

HardCoded Backdoor Found in China-made Netis, Netcore Routers

Routers manufactured and sold by Chinese security vendor have a hard-coded password that leaves users with a wide-open backdoor that could easily be exploited by attackers to monitor the Internet traffic. The routers are sold under the brand name Netcore in China, and Netis in other parts of the...

CVE-2014-3596

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subjec...