CVE-2014-5527

The CVE-2014-5527 entry concerns the Tapjoy library for Android, which does not verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as described in multiple connected records. ...

CVE-2014-5534

CVE-2014-5534 concerns the Princess Shopping (air.android.PrincessShopping) Android application 2, which does not verify X.509 certificates from SSL servers. This lack of certificate validation can allow man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information thro...

CVE-2014-5596

CVE-2014-5596 affects the Android app Homerun Battle 2 (com.com2us.homerunbattle2.normal.freefull.google.global.android.common) version 1.2.2.0. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which can allow a man-in-the-middle attacker to spo...

CVE-2014-5524

The Adcolony library for Android does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. This vulnerability (CVE-2014-5524) has a CVSSv2 base score of 5.4 (Medium) with Confidentiality, ...

CVE-2014-5630

The Home Repair Android app (package com.gcspublishing.houserepairtalk) version 3.7.9 does not verify X.509 certificates from SSL servers. This permits man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Root cause: lack of TLS certificate vali...

CVE-2014-5687

The CVE-2014-5687 entry affects the Runtastic Mountain Bike Android app (2.0.1) and is due to the app not verifying X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The issue is documented across multiple sou...

CVE-2014-5635

The CVE-2014-5635 entry concerns the Android app Buy Yorkshire Conference (com.gotfocus.buyyorkshire) version 1.4, which fails to verify X.509 certificates from SSL servers. This creates a certificate validation bypass, allowing man-in-the-middle attackers to spoof legitimate servers and extract ...

CVE-2014-5542

The CVE-2014-5542 entry applies to the Android app The Hidden Object Mystery (air.com.differencegames.hodetectivemysteryfree) v1.0.65, where the app does not verify X.509 SSL certificates. This prevents server authentication, enabling MITM attackers to spoof HTTPS servers and access sensitive dat...

CVE-2014-5591

The CVE-2014-5591 entry applies to the Frankly Chat (com.chatfrankly.android) app version 3.0.1 on Android, where TLS/SSL certificate verification is not performed, enabling MITM attackers to spoof servers and access sensitive data via a crafted certificate. Root cause: the app does not verify X....

CVE-2014-5679

The CVE ties to the Android app PopU 2: Get Likes on Instagram (package: com.popuapp.popu) version 1.7.5 . The vulnerability is that the app does not verify X.509 certificates from SSL servers , enabling potential man-in-the-middle attackers to spoof servers and access sensitive information via a...

CVE-2014-5641

CVE-2014-5641 affects the Cloud Manager (com.ileaf.cloud_manager) Android app v1.6. The vulnerability is due to failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive data via a crafted certificate. Documented impact is ex...

CVE-2014-5684

The Runtastic Running & Fitness aka com.runtastic.android application 5.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5648

CVE-2014-5648 affects the Android app “Chat, Flirt & Dating Heart JAUMO” (com.jaumo) at version 2.7.5. The vulnerability is that the app does not verify X.509 certificates when connecting to SSL servers, which enables a man-in-the-middle attacker to spoof servers and exfiltrate sensitive data via...

CVE-2014-5554

The Fun Preschool Creativity Game aka air.com.tribalnova.ilearnwith.ipad.MotherAppEn application 1.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Chinese Government Accused of Intercepting Traffic Between Google and CERNET

So far, we all are well aware of the fact that Chinese have had a past filled with cases of Cyber Crime. China is the world’s largest exporter of IT goods, but it has been criticized by many countries due to suspected backdoors in its products, including United States which has banned its several...

CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

Fake Cell Phone Towers Could Be Intercepting Your Calls

A notable number of cell phone towers around the United States are rogue that, according to latest report, could spoof legitimate towers and intercept calls. The research carried out by ESD America, a defense and law enforcement technology firm based in Las Vegas, shows that a rogue cell phone...

CentOS 7 : httpcomponents-client (CESA-2014:1146)

Updated httpcomponents-client packages that fix one security issue are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

HardCoded Backdoor Found in China-made Netis, Netcore Routers

Routers manufactured and sold by Chinese security vendor have a hard-coded password that leaves users with a wide-open backdoor that could easily be exploited by attackers to monitor the Internet traffic. The routers are sold under the brand name Netcore in China, and Netis in other parts of the...

CVE-2014-3596

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subjec...