Design/Logic Flaw

The Liburan Hemat aka com.liburan.bro application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Dattch - The Lesbian App aka com.dattch.dattch.app application 0.30 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7360

The How To Boil Eggs aka com.appmakr.app842173 application 251333 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7444

The Baidu Navigation aka com.baidu.navi application 3.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7435

The AJD Bail Bonds aka com.onesolutionapps.ajdbailbondsandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7472

The CSApp - Colegio San Agustin aka com.goodbarber.csapp application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7387

The ACC Advocacy Action aka com.acc.app.android.ui application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7408

The Gary Johnson for President '12 aka com.GaryJohnson2012 application 0.75.13439.53899 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7464

CVE-2014-7464 concerns the Android app “The Magic Stamp” (aka vn.avagame.apotatem) version 2.8, where the client fails to verify X.509 certificates from SSL servers. This root cause allows MITM attackers to spoof the server and potentially leak sensitive information via a crafted certificate. The...

CVE-2014-7458

The CVE-2014-7458 entry concerns the BloomYou Valentine Android app (package com.bloomyouteam.bloomyou.valentine, version 2.4). The vulnerability is failed TLS/SSL certificate validation: the app does not verify X.509 certificates from SSL servers. This allows an attacker to perform man-in-the-mi...

CVE-2014-7330

The XtendCU Mobile aka com.metova.cuae.xtend application 1.0.28 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7358

The Vermont Powder aka com.concursive.vermontpowder application 4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7470

The CVE-2014-7470 entry concerns the I Know the Movie Android app (com.guilardi.jesaislefilm2), specifically jesais_film_android_1.1. The vulnerability is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and exfiltrate...

CVE-2014-7416

The CVE-2014-7416 entry concerns the Craft Stamper Magazine Android app (com.triactivemedia.craftstamper). The underlying issue is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

CVE-2014-7108

The CVE-2014-7108 entry concerns the Android app Stop Headaches and Migraines (com.StopHeadachesandMigraines) version 1.2, which does not verify X.509 certificates when establishing SSL connections. This misconfiguration enables man-in-the-middle attackers to spoof SSL servers and obtain sensitiv...

CVE-2014-7316

The Safe Arrival aka com.synrevoice.safearrival application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7125

The Motor (com.magzter.motorhwpublishing) Android app, version 3.0, fails to verify X.509 certificates when establishing SSL connections. This allows a man‑in‑the‑middle attacker to spoof servers and obtain sensitive information via a crafted certificate. The vulnerability affects trust in SSL/TL...

CVE-2014-7405

The Belaire Family Orthodontics aka com.appbf.layout application 1.304 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7457

The CVE-2014-7457 entry concerns the Electronics For You Android app (com.magzter.electronicsforyou) version 3.02, where SSL server certificate verification is not performed. This allows MITM attackers to spoof servers and exfiltrate sensitive data via a crafted certificate. The issue is describe...

CVE-2014-7445

The LEGEND OF TRANCE aka com.legendoftrance application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...