Design/Logic Flaw

APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors...

CVE-2014-7758

The CVE-2014-7758 entry corresponds to the AMKAMAL Science Portfolio Android app (package com.wAMKAMALSciencePortfolio) version 0.1, where the vulnerability is an inability to verify X.509 certificates from SSL servers. The root cause is missing TLS/SSL certificate validation, which can allow man...

PT-2014-8237

Name of the Vulnerable Software and Affected Versions NASIOC aka net.endoftime.android.forumrunner.nasioc version 3.8.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

PT-2014-8269

Name of the Vulnerable Software and Affected Versions com.magzter.schonmagazine version 3.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL servers...

PT-2014-8138

Name of the Vulnerable Software and Affected Versions ydx.android application version 1.0.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates from SSL...

PT-2014-8076

Name of the Vulnerable Software and Affected Versions com.dreamstep.wHEADLINESNEWSINDIA version 0.21.13219.95110 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509...

PT-2014-8132

Name of the Vulnerable Software and Affected Versions Kadinlar Kulubu KKMobileApp version 3.4.3 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL...

Information disclosure

The Argus Leader Print Edition aka com.argusleader.android.prod application 6.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7345

The CVE-2014-7345 entry concerns the DIYChatroom Android app (package com.tapatalk.diychatroomcom) version 3.4.0. Affected component: SSL/TLS certificate verification is missing when validating server certificates, allowing a man-in-the-middle to spoof servers and reveal sensitive information via...

Information disclosure

The Gulf Coast Educators FCU aka com.metova.cuae.gcefcu application 1.0.27 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7917

Name of the Vulnerable Software and Affected Versions com.makeitpossible.CuantoConocesAunAmigo version 2.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates fr...

PT-2014-8018

Name of the Vulnerable Software and Affected Versions The Magic Stamp aka vn.avagame.apotatem version 2.8 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates...

PT-2014-7686

Name of the Vulnerable Software and Affected Versions UTSA Mobile aka com.dub.app.utsa version 1.4.21 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SS...

PT-2014-7683

Name of the Vulnerable Software and Affected Versions com.nobexinc.wls 24832536.rc version 3.3.5 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates from SSL...

PT-2014-7703

Name of the Vulnerable Software and Affected Versions com.myapphone.android.myappibispaucentre version 1.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates fr...

PT-2014-7642

Name of the Vulnerable Software and Affected Versions net.parentlink.westbend application version 4.0.500 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates...

PT-2014-7705

Name of the Vulnerable Software and Affected Versions com.rareartifact.dukanpasoapaso82BE0897 version 1.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates...

Design/Logic Flaw

The confirmcreateaccount function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attacke...

CVE-2014-1572

The confirmcreateaccount function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attacke...

CVE-2014-1572: Undefined Security Weakness

The confirmcreateaccount function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for the realname parameter, which allows remote attacke...