CVE-2014-5691

The Best Phone Security aka com.rvappstudios.phonesecurity application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5570

The DailyFinance - Stocks & News aka com.aol.mobile.dailyFinance application 2.0.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5601

The CVE-2014-5601 issue affects the Android app 1800CONTACTS (com.contacts1800.ecomapp) version 2.7.0, where the app does not verify SSL/TLS X.509 certificates when establishing HTTPS connections. Root cause: missing/incorrect certificate validation logic allows MITM attackers to spoof servers an...

CVE-2014-5585

The CVE-2014-5585 entry applies to the Android app “Like4Like: Get Instagram Likes” (package com.bepop.bepop) version 2.1.5. Multiple connected sources confirm the root cause: the app does not verify X.509 certificates when establishing SSL/TLS connections, allowing MITM attackers to spoof server...

CVE-2014-5636

The Cloud Browser aka com.granitamalta.cloudbrowser application 2.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5647

The CVE-2014-5647 entry concerns the ISL Light Remote Desktop Android app (com.islonline.isllight.mobile.android) version 2.1.0, which does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attackers to spoof servers and access sensitive...

CVE-2014-5556

The CVE-2014-5556 entry refers to the Fly Fishing & Fly Tying Android app (version 3.21.0, package air.com.yudu.ReaderAIR3209899) failing to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certific...

CVE-2014-5528

The Appsflyer library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Android App SSL Certificate Validation Errors Enumerated

A growing compilation of close to 350 Android applications that fail to perform SSL certificate validation over HTTPS has been put together by the CERT Coordination Center at the Software Engineering Institute at Carnegie Mellon University. Researcher Will Dormann created a large spreadsheet host...

Medium: libserf

Issue Overview: The 1 serfsslcertissuer, 2 serfsslcertsubject, and 3 serfsslcertcertificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attacke...

Design/Logic Flaw

The 1 serfsslcertissuer, 2 serfsslcertsubject, and 3 serfsslcertcertificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof...

CVE-2014-3504

CVE-2014-3504 (Serf) affects the Serf SSL certificate handling in Serf 0.2.0–1.3.x prior to 1.3.7, where a NUL byte in a domain name within the certificate’s subject CN could allow a remote attacker to spoof an SSL server (MITM). The issue stems from improper parsing/validation of CN in X.509 cer...

Ubuntu 14.04 LTS : Thunderbird vulnerabilities (USN-2296-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2296-1 advisory. Christian Holler, David Keeler and Byron Campen discovered multiple memory safety issues in Thunderbird. If a user were tricked in to opening a specially...

Apache 2.4.7 mod_status - Scoreboard Handling Race Condition

Apache 2.4.7 modstatus - Scoreboard Handling Race Condition -- 0. Sparse summary Race condition between updating httpd's "scoreboard" and modstatus, leading to several critical scenarios like heap buffer overflow with user supplied payload and leaking heap which can leak critical memory containin...

Fedora 20 : claws-mail-3.10.1-1.fc20 / claws-mail-plugins-3.10.1-1.fc20 (2014-7577)

New in this release : - Add an account preference to allow automatically accepting unknown and changed SSL certificates, if they're valid that is, if the root CA is trusted by the distro. - RFE 3196, 'When changing quicksearch Search Type, set focus to search input box' - PGP/Core plugin: Generat...

Gmail App for iOS leaves Users vulnerable to Man-in-the-Middle Attacks

Google has failed to provide a very important security measure in its Gmail application for iOS that left millions of its Apple device users to Man-in-the-Middle MitM attacks capable of monitoring encrypted email communications. Researcher at mobile security firm Lacoon has discovered that Google...

Mozilla Browser 0.8/0.9/1.x Refresh Security Property Spoofing Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10796/info Mozilla and Firefox may permit malicious Web pages to spoof security properties of a trusted site. An attacker can exploit this issue to spoof the URI and SSL certificate of a site trusted by an unsuspecting...

Sysax <= 5.60 Create SSL Certificate Buffer Overflow

No description provided by source...

RelateIQ: Failed Certificate Validation On Custom Server (Register)

Hi, in the register page a custom server can be used to define "where to connect to". Your system does not validate the SSL certificate of this host which makes it easy to tamper with the data your system do in behalf of the user. As only SSL links are allowed by the application the user could...

openSUSE Security Update : gnome-online-accounts (openSUSE-SU-2013:0301-1)

gnome-online-accounts was updated to do SSL certicicate checking when creating accounts, avoiding man-in-the-middle attack possibilities. CVE-2013--240 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security...