CVE-2014-5622

The Follow Mania for Instagram aka com.followmania application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5615

CVE-2014-5615 affects the Snap Secure app (com.exclaim.snapsecure.app) version 9.5 for Android, where SSL/TLS certificate verification is not performed. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. The vulnerability details ar...

CVE-2014-5545

The CVE-2014-5545 entry documents a vulnerability in the Sprint jump (aka air.com.ilaz.appilas) Android app, where the application does not verify X.509 certificates from SSL servers. The underlying issue is missing certificate validation, which allows a man-in-the-middle attacker to spoof server...

CVE-2014-5662

CVE-2014-5662 affects the Android app Rail Rush (com.miniclip.railrush) version 1.9.0. The vulnerability is due to the app not performing X.509 certificate validation for SSL servers, which enables man-in-the-middle attackers to spoof trusted servers and exfiltrate sensitive information via a cra...

CVE-2014-5611

The CVE-2014-5611 entry concerns the Android app com.ebay.kleinanzeigen (Germany) version 5.0.2, which does not verify X.509 certificates from SSL servers. This creates a risk of MITM disclosure of sensitive information via crafted certificates. The available connected documents corroborate that ...

PT-2014-6772

Name of the Vulnerable Software and Affected Versions The Ninja Chicken application version 1.7.6 Description The issue concerns the application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

PT-2014-6719

Name of the Vulnerable Software and Affected Versions The Buy Books aka com.wBooksForSale application version 0.1 Description The issue concerns the application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-6661

Name of the Vulnerable Software and Affected Versions The Township aka com.playrix.township version 1.5.1 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

PT-2014-6514

Name of the Vulnerable Software and Affected Versions Appsflyer library for Android affected versions not specified Description The issue concerns the Appsflyer library for Android, which fails to verify X.509 certificates from SSL servers. This oversight allows man-in-the-middle attackers to spo...

PT-2014-6569

Name of the Vulnerable Software and Affected Versions BeenVerified application version 4.01.67 Description The issue concerns the BeenVerified application's failure to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-6657

Name of the Vulnerable Software and Affected Versions NQ Mobile Security & Antivirus version 7.2.16.00 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from S...

PT-2014-6710

Name of the Vulnerable Software and Affected Versions Truecaller - Caller ID & Block aka com.truecaller version 4.32 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

PT-2014-6808

Name of the Vulnerable Software and Affected Versions The Cleaner - Speed up & Clean aka com.liquidum.thecleaner version 1.4.2 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not veri...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

jakarta-commons-httpclient security update

1:3.1-16 - Fix MITM security vulnerability - Resolves: CVE-2014-3577...

New Firefox 32 Adds Protection Against MiTM Attack and Rogue Certificates

Good news for Firefox lovers! The Mozilla Foundation has introduced a bunch of new features in Firefox to improve browser security with the launch of Firefox 32, now available for Windows, Mac, Linux, and Android platforms. The new version of Firefox makes the browser even more competitive among...

UBUNTU-CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via...

httpcomponents-client security update

4.2.5-5 - Fix MITM security vulnerability - Resolves: CVE-2014-3577...

Multiple Android applications fail to properly validate SSL certificates

Overview Multiple Android applications fail to properly validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle MITM attack. Description When communicating via HTTPS, an application should validate the SSL chain to be sure that the...

Mozilla to Support Key Pinning in Firefox 32

Mozilla is planning to add support for public-key pinning in its Firefox browser in an upcoming version. In version 32, which would be the next stable version of the browser, Firefox will have key pins for a long list of sites, including many of Mozilla’s own sites, all of the sites pinned in...