CVE-2014-6865

The Jamal Bates Show aka com.conduit.app3a95e13827c54c4da9056fafb33ecc8d.app application 1.3.14.254 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6885

The CVE-2014-6885 vulnerability affects the Academy Sports + Outdoors Visa Android app (package com.usbank.icsmobile.academysports) version 1.18, where SSL servers’ X.509 certificates are not verified. This underpins a man-in-the-middle risk, allowing an attacker to spoof servers and access sensi...

Design/Logic Flaw

The New Beginnings CFC aka com.goodbarber.nbcfc application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6855

CVE-2014-6855 concerns the Android app Long (com.imop.longjiang.android) v1.0.4, where the app does not verify X.509 certificates from SSL servers. This behavior enables man-in-the-middle attackers to spoof servers and potentially obtain sensitive information via a crafted certificate. The connec...

CVE-2014-6848

The DS file aka com.synology.DSfile application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6839

The Alma Corinthiana aka com.alma.corinthiana application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Daily Advertiser Print aka com.lafayettedailyadv.android.prod application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6838

The CVE-2014-6838 entry concerns the Groupama Toujours la app (com.groupama.toujoursla) for Android version 1.3.0, where X.509 certificate validation for SSL servers is not performed. This insecure cert handling can allow man-in-the-middle attackers to spoof servers and exfiltrate sensitive infor...

CVE-2014-6847

CVE-2014-6847 corresponds to the Android app Horoscopes and Dreams (com.horoscopesanddreams) version 1.0.1, which does not verify X.509 certificates when making SSL connections. The root cause is missing SSL certificate validation, allowing man-in-the-middle attackers to spoof servers and exfiltr...

CVE-2014-6846

CVE-2014-6846 concerns the Android app “The Four Seasons Beverly Hills” (com.intelitycorp.FourSeasons.android.ice, package @7F050007). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling an attacker in a man‑in‑the‑middle position to spoof servers and o...

CVE-2014-6847

The Horoscopes and Dreams aka com.horoscopesanddreams application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5444

Geary

CVE-2014-6833

The AuctionTrac Dealer aka com.adesa.dealer.phone application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6817

The Cove aka org.covechurch.app application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6820

The Amebra Ameba aka jp.honeytrap15.amebra application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Command injection

The Covet Fashion - Shopping Game aka com.crowdstar.covetfashion application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6836

The DS photo+ aka com.synology.dsphoto application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6815

CVE-2014-6815 affects the Android Vouch! app (com.voucherry.voucherry) version 2.1.6, where SSL certificate validation is not performed. The root cause is failure to verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and access sensitive information ...

CVE-2014-6832

CVE-2014-6832 affects the Android app The Bersa Forum (package com.gcspublishing.bersaforum) version 3.9.16. The vulnerability is that the app does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and potentially obtain sensitive information via a crafted c...

CVE-2014-6829

The Hook aka com.hook.android application 0.9.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...