Design/Logic Flaw

The Magic Balloonman Marty Boone aka com.appmartyboone.layout application 1.400 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Intelligent SME aka com.magzter.intelligentsme application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Taking Your Company Public aka biz.app4mobile.app016e43d03ee54d1facd6c9532a00e724.app application 1.28.44.441 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7115

The Letters to God - soc. network aka com.wPismakBoguLetterstoGod application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7055

The NCCI's Annual Issues Symposium aka com.quickmobile.ais14 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The NBE aka com.nbe.app application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6981

CVE-2014-6981 affects the Taiwan Business Bank Android app (com.mitake.TBB) version 2.04. The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive information via a crafted certificate. Connec...

POODLE SSL 3.0 Attack Exploits Widely-used Web Encryption Standard

Another Heartbleed-like vulnerability has been discovered in the decade old but still widely used Secure Sockets Layer SSL 3.0 cryptographic protocol that could allow an attacker to decrypt contents of encrypted connections to websites. Google's Security Team revealed on Tuesday that the most...

Code injection

The Physics Chemistry Biology Quiz aka com.pdevsmcqs.pcbmcqseries application 1.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The EXPRESS aka com.gpshopper.express.android application 2.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Academy Sports + Outdoors Visa aka com.usbank.icsmobile.academysports application 1.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Second Same-Origin Policy Bypass Flaw Haunts Android Browser

There is another same-origin policy bypass vulnerability in the Android browser in versions prior to 4.4 that allows an attacker to steal data from a user’s browser. Google has fixed the vulnerability in some versions of Android, but millions of users of older versions are still affected. The...

Design/Logic Flaw

The Arch Friend aka com.xyproto.archfriend application 0.4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Melodigram aka com.minusdegree.melodigramandroid application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

live800在线沟通平台客户端存储型XSS可攻击客服

简要描述： 帮朋友测试项目时无意间发现的。 详细说明： 我没有做过大量统计和测试，但根据我这几个月零零散散的测试我认为仍然存有大量的桌面应用，web应用和浏览器插件存有一摸一样的问题。 所以，这个XSS的输入点还是文件名。 漏洞证明： 首先我们构造这样的文件名： .jpg 随后通过http://x55.me/800.htm向客服发送文件，如下图： 现在切换到客服的应用界面，看发生了什么？...

Code injection

The Apploi Job Search- Find Jobs aka com.apploi application 4.19 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Leadership Newspapers aka com.LeadershipNewspapers application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5981

The MoWeather aka com.moji.moweather application 1.40.05 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Dyre Trojan Targeting More than Salesforce.com Credentials

The criminals who unleashed a variant of the Dyre banking Trojan recently may have more up their sleeve than harvesting Salesforce.com credentials. Analysis of a sample conducted by SaaS security company Adallom determined that the new strain of Dyre is targeting large enterprises in addition to...

Design/Logic Flaw

The Flurv Chat aka com.flurv.android application 4.3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...