CVE-2014-7643

The CVE-2014-7643 entry concerns the C.R. Group (aka com.c.r.group) Android application version 1.0, which does not verify X.509 certificates from SSL servers. This failure allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The connecte...

CVE-2014-7663

The CVE-2014-7663 entry describes a vulnerability in the Android application “The Right to the Nitty Gritty” (com.wGoNittyGritty) version 0.1, where the app does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive informati...

Chinese Government Executes MITM Attack against iCloud

Apple iCloud users in China are not safe from the hackers — believed to be working for Chinese government — who are trying to wiretap Apple customers in the country. Great Fire, a reputed non-profit organization that monitors Internet censorship in China, claimed that the Chinese authorities have...

CVE-2014-7624

The Guess the Pixel Character Quiz aka com.aiadp.pixelcQuiz application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7559

The InstaTalks aka com.natrobit.instatalks application 1.3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7562

The Health Advocate SmartHelp aka com.healthadvocate.ui application 3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7488

The Vineyard All In aka com.wVineyardAllIn application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Bodyguard for Hire aka com.dreamstep.wBodyGuardforHire application 0.18.13146.42280 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Kontan Kiosk aka com.appsfoundry.scoopwl.id.kontankiosk application @7F07025E for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7505

The CVE-2014-7505 entry concerns the AppTalk (com.chatatami.apptalk) Android app version 1.4.8, which does not verify X.509 SSL certificates. This allows MITM attackers to spoof servers and access sensitive information via a crafted certificate. The initial data indicates partial impact to confid...

CVE-2014-7559

CVE-2014-7559 affects the InstaTalks Android app (com.natrobit.instatalks) version 1.3.1. The root cause is failure to verify X.509 certificates from SSL servers, which can allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The NVD recor...

CVE-2014-7555

The Apparound BLEND aka com.apparound.mobile.catalogo application 4.9.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7543

The Blood app (com.sheridan.ash) for Android, version 2.1, does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and intercept sensitive information. Root cause: missing certificate validation. Impact: potential disclosure of sensitive data. Exploitation de...

SSL 3.0 MITM Attack

A vulnerability affecting most implementations of SSL 3.0 has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions CVE-2014-3566. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak...

SSL 3.0 MITM Attack

A vulnerability affecting most implementations of SSL 3.0 has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions CVE-2014-3566. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak...

Yahoo in China suffered a SSL man in the middle attacks-vulnerability warning-the black bar safety net

Latest update: Off 1 0 on 2 0 PM 1 6: 4 to 6 points, attacks still continue......... 2 0 1 4 years 1 0 month 2 0 Day 1 4:3 0, Yahoo in mainland China once again under SSL man in the middle attacks, the domestic three operators to access all there is a problem, and Hong Kong, the United States,...

Palo Alto Networks PAN-OS < 5.0.14 / 5.1.x < 5.1.9 / 6.0.x < 6.0.4 OpenSSL MitM

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.14 / 5.1.9 / 6.0.4. It is, therefore, affected by a flaw in the included OpenSSL library that can cause the client or server to use weak keying material, which a remote attacker can exploit to conduct a man-in-the-midd...

CVE-2014-7456

The Digit Magazine aka com.magzter.digitmagazine application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7384

The Joe's Lawn Service aka com.appexpress.joeslawnservice application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7328

The brain abundance info aka com.wbrainabundance application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...