Information disclosure

Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2016-1221

Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates...

Design/Logic Flaw

The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2016-1187

Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates...

CVE-2016-1198

Photopt for Android before 2.0.1 does not verify SSL certificates...

Code injection

The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate...

CVE-2016-1519

Affected software: Grandstream Wave app for Android (package com.softphone.common), versions up to and including 1.0.1.26. Vulnerability: Improper SSL certificate validation in the app’s provisioning flow. Impact: Enables MITM attackers to spoof the Grandstream provisioning server via a crafted c...

Code injection

Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates...

CVE-2016-1184

Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates...

CVE-2016-4832

WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates...

CVE-2016-1148

CVE-2016-1148 affects Akerun – Smart Lock Robot App for iOS prior to v1.2.4, where the iOS app fails to verify SSL server certificates. This undermines TLS trust and can enable a man-in-the-middle attack to eavesdrop on encrypted traffic. The issue is documented in multiple sources (including JVN...

Code injection

An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will connect via Transport Layer Security without verifying the peer's SSL certificate properly...

CVE-2017-5160

An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will connect via Transport Layer Security without verifying the peer's SSL certificate properly...

CVE-2017-5160

Schneider Electric Wonderware InTouch Access Anywhere (versions up to 11.5.2) is affected by CVE-2017-5160: Inadequate TLS certificate verification causes TLS connections to not properly verify peers, exposing confidentiality and integrity during network communications. The issue is triggered in ...

CVE-2017-5160

An Inadequate Encryption Strength issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. The software will connect via Transport Layer Security without verifying the peer's SSL certificate properly...

This Phishing Attack is Almost Impossible to Detect On Chrome, Firefox and Opera

A Chinese infosec researcher has reported about an "almost impossible to detect" phishing attack that can be used to trick even the most careful users on the Internet. He warned, hackers can use a known vulnerability in the Chrome, Firefox and Opera web browsers to display their fake domain names...

Ubiquiti Inc.: Expired SSL certificate

https://uwncom-stage.ec2-us-east-1.us1.svc.ubnt.com/ The above domain uses an SSL certificate which expired 50 days ago...

CVE-2017-7192

WebSocket.swift in Starscream before 2.0.4 allows an SSL Pinning bypass because of incorrect management of the certValidated variable it can be set to true but cannot be set to false...

CVE-2017-7192

The CVE-2017-7192 entry concerns the Starscream WebSocket library (WebSocket.swift) up to version 2.0.3, where SSL pinning can be bypassed due to incorrect handling of certValidated (it can be set to true but not to false). This enables a man-in-the-middle attack during re-connection after a TCP ...