CVE-2014-5561

The Word Search Free aka air.wordSearchFree application 4.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5538

The Westmoreland Water FCU aka air.com.creditunionhomebanking.mb115 application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5611

The eBay Kleinanzeigen for Germany aka com.ebay.kleinanzeigen application 5.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5611

The CVE-2014-5611 entry concerns the Android app com.ebay.kleinanzeigen (Germany) version 5.0.2, which does not verify X.509 certificates from SSL servers. This creates a risk of MITM disclosure of sensitive information via crafted certificates. The available connected documents corroborate that ...

CVE-2014-5670

CVE-2014-5670 affects the Android app SAS: Zombie Assault 3 (package com.ninjakiwi.sas3zombieassault), version 2.56. Root cause: the app does not verify X.509 certificates when communicating with SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via a crafted ...

CVE-2014-5643

The Instachat -Instagram Messenger aka com.instachat.android application 1.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5601

The CVE-2014-5601 issue affects the Android app 1800CONTACTS (com.contacts1800.ecomapp) version 2.7.0, where the app does not verify SSL/TLS X.509 certificates when establishing HTTPS connections. Root cause: missing/incorrect certificate validation logic allows MITM attackers to spoof servers an...

CVE-2014-5682

The Retale - Weekly Ads & Deals aka com.retale.android application 2.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5574

The Ask.fm - Social Q&A Network aka com.askfm application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5686

The Runtastic Me aka com.runtastic.android.me.lite application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Passera - Tool to generate strong unique passwords for each website

A simple tool that allows users to have strong unique passwords for each website, without the need to store them either locally or with an online service. It is available as a command-line tool for Linux/Mac/Windows and an Android app. Passera turns any entered text into a strong password up to 6...

CVE-2014-3902

The CyberAgent Ameba application 3.x and 4.x before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

JR East Japan App for Android. contains an issue where it fails to verify SSL server certificates

Overview JR East Japan App for Android. contains an issue where it fails to verify SSL server certificates. Akihisa Ishida reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-minddle attack may allo...

050 plus for Android information management vulnerability

Overview 050 plus for Android contains an information management vulnerability. 050 plus provided by NTT Communications is an IP phone application for smartphones. 050 plus for Android contains an information management vulnerability that outputs some pieces of information stored by the product t...

Faceless: Account hijacking possible through ADB backup feature

It was found that if an attacker had access to an unlocked phone, they could take any data from the application's sandbox through ADB's backup feature. Normally ADB backup allows applications to be backed up to the cloud. This means that if a user replaces or wipes their phone, they can restore a...

CVE-2014-2992

The Misli.com application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-2992

The Misli.com Android app is affected by CVE-2014-2992: it does not verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. This is a certificate validation weakness in the app’s SSL/TLS handling. The NVD ent...

CVE-2014-1976

The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Demaecan for Android. contains an issue where it fails to verify SSL server certificates

Overview Demaecan for Android. contains an issue where it fails to verify SSL server certificates. kurisu and matt reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A man-in-the-minddle attack may allow an...

CVE-2014-1887

The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated b...