Information disclosure

The Kiss Kiss Office aka com.girlsgames123.kisskissoffice application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Brightest LED Flashlight aka com.intellectualflame.ledflashlight.washer application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The hasbehaal aka com.anawaz.hasbehaal application 1.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Double free

The Akinator the Genie FREE aka com.digidust.elokence.akinator.freemium application 2.46 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5643

The CVE-2014-5643 entry concerns the Instachat – Instagram Messenger Android app (com.instachat.android), version 1.6.2. Root cause: the app does not verify X.509 certificates from SSL servers. Impact: enables man‑in‑the‑middle attackers to spoof servers and access sensitive information via a cra...

CVE-2014-5627

The CVE-2014-5627 entry concerns the Ice Age Village Android app (com.gameloft.android.ANMP.GloftIAHM) version 2.8.0m, where SSL servers are not verified due to missing X.509 certificate verification. This allows a man-in-the-middle to spoof servers and obtain sensitive information via a crafted ...

CVE-2014-5625

The CVE-2014-5625 issue affects The Perfect Kick app (com.gamegou.PerfectKick.google) on Android 1.3.0, where SSL/TLS servers are not verified due to missing X.509 certificate validation. This enables MITM attackers to spoof servers and exfiltrate sensitive data via crafted certificates. The prov...

CVE-2014-5598

The Puzzle Family (com.com2us.puzzlefamily.up.freefull.google.global.android.common) Android app 1.2.0 is affected by CVE-2014-5598 due to not verifying X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certif...

CVE-2014-5668

CVE-2014-5668 affects the BAND - Group sharing & planning (com.nhn.android.band) Android app version 3.2.8. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted c...

CVE-2014-5535

CVE-2014-5535 affects The Baby Get Up - Kids Care (aka air.brown.jordansa.getup) Android app, version 1.0.3. The issue is that the app does not verify X.509 certificates when connecting to SSL servers, enabling potential MITM attackers to spoof servers and access sensitive data via a crafted cert...

CVE-2014-5647

The CVE-2014-5647 entry concerns the ISL Light Remote Desktop Android app (com.islonline.isllight.mobile.android) version 2.1.0, which does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attackers to spoof servers and access sensitive...

CVE-2014-5560

The CVE-2014-5560 entry concerns the Android app Popscene (Music Industry Sim) / air.Popscene version 1.04 that fails to verify SSL X.509 certificates. Root cause: missing certificate validation in SSL/TLS connections, which can allow MITM attackers to spoof servers and capture/reveal sensitive i...

CVE-2014-5537

The Abduction Stacker Free aka air.com.chewygames.abductionstacker2 application 1.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5690

The Runtastic Timer aka com.runtastic.android.timer application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5549

Summary: CVE-2014-5549 affects the Android app Puppy Slots Free (air.com.starluxstudios.PuppySlotsFree) v3. The issue is that the app does not verify X.509 certificates from SSL servers, allowing a man-in-the-middle to spoof servers and harvest sensitive information via a crafted certificate. Wha...

CVE-2014-5580

The CVE-2014-5580 entry affects the BackgroundCheckProTool Android app (com.BackgroundCheckProTool) v3.5. The root cause is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...

CVE-2014-5584

The CVE-2014-5584 entry concerns the Android app BeenVerified (com.beenverified.android) version 4.01.67, where SSL servers are not validating X.509 certificates. This allows a man-in-the-middle to spoof servers and access sensitive data via a crafted certificate. The issue is tied to the app’s T...

CVE-2014-5585

The CVE-2014-5585 entry applies to the Android app “Like4Like: Get Instagram Likes” (package com.bepop.bepop) version 2.1.5. Multiple connected sources confirm the root cause: the app does not verify X.509 certificates when establishing SSL/TLS connections, allowing MITM attackers to spoof server...

CVE-2014-5632

The CVE-2014-5632 entry concerns the Android game Mega Jump (package com.getsetgames.megajump). The issue is that the app does not verify X.509 certificates from SSL servers, creating a man-in-the-middle risk where an attacker could spoof TLS endpoints and exfiltrate sensitive information via a c...

CVE-2014-5547

CVE-2014-5547 affects the Mahjong Galaxy Space Lite app (Android, package air.com.permadi.mahjongIris) version 2.5. The vulnerability is failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted cert...