CVE-2017-9573

The North Adams State Bank Ursa nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9578

The "RVCB Mobile" by RVCB Mobile Banking app 3.0.0 -- aka rvcb-mobile/id757928895 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9565

The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9563

The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Citizens Bank TX cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2017-9590

The "State Bank of Waterloo Mobile Banking" by State Bank of Waterloo app 3.0.2 -- aka state-bank-of-waterloo-mobile-banking/id555321714 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

CVE-2017-9559

The CVE-2017-9559 entry concerns the MEA Financial Vision Bank iOS app (version 3.0.1) failing to verify X.509 certificates from SSL servers. The underlying issue is lack of proper certificate validation, which can allow man-in-the-middle attackers to spoof servers and obtain sensitive informatio...

CVE-2017-9570

The CVE-2017-9570 entry refers to the iOS app mount-vernon-bank-trust-mobile-banking/id542706679 (version 3.0.0) that does not verify X.509 certificates from SSL servers, enabling potential MITM attackers to spoof servers and access sensitive information via a crafted certificate. This vulnerabil...

CVE-2017-9596

The CVE-2017-9596 entry concerns the iOS app “CFB Mobile Banking” (Citizens First Bank Wisconsin), version 3.0.1 (cfb-mobile-banking/id1081102805). The vulnerability is a failure to verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensit...

CVE-2017-9562

CVE-2017-9562 affects the Freedom First freedom-1st-credit-union-mobile-banking/iOS app (version 3.0.0). The root cause is failure to verify X.509 certificates from SSL servers, enabling MITM attackers to spoof servers and potentially obtain sensitive information via a crafted certificate. Exploi...

CVE-2017-9574

The "KC Area Credit Union Mobile Banking" by K C Area Credit Union app 3.0.1 -- aka kc-area-credit-union-mobile-banking/id1097607736 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafte...

CVE-2017-9560

The CVE-2017-9560 entry concerns the Cayuga Lake National Bank iOS app (version 4.0.1) failing to verify X.509 certificates from SSL servers. This root issue enables man-in-the-middle attackers to spoof servers and exfiltrate sensitive information via a crafted certificate. The vulnerability is d...

PUMA PUMATRAC app for iOS Authentication Vulnerability

PUMA PUMATRAC app for iOS is a running management app from Puma Germany. The program has features such as recording running distance, speed and calories burned. An authentication vulnerability exists in version 3.0.2 of the PUMA PUMATRAC app for iOS, which stems from the program's failure to...

YottaMark ShopWell - Healthy Diet and Grocery Food Scanner app for iOS Authentication Vulnerability

YottaMark ShopWell - Healthy Diet and Grocery Food Scanner app for iOS is a healthy diet management software from YottaMark ShopWell, USA. The app provides users with information about the ingredients of food products by scanning their barcodes. A security vulnerability exists in the iOS-based...

PayQuicker app SSL certificate validation vulnerability

PayQuicker app for iOS is a fast payment solution based on iOS. A security vulnerability exists in version 1.0.0 of the PayQuicker app for iOS, which stems from the program failing to validate an X.509 certificate on the server side of an SSL server. The vulnerability can be exploited to conduct ...

Think Mutual Bank Mobile Banking app SSL Certificate Validation Vulnerability

Think Mutual Bank mobile banking app for iOS is a mobile banking app for iOS from Think Mutual Bank that provides quick access to manage customer accounts, manage balances, pay bills, send money, deposit checks, set up text alerts, find branch and ATM locations and more. A security vulnerability...

CVE-2017-8943

The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Microsoft OneDrive iOS App 8.13 Insecure URI Scheme Handling

A short demo video is available here: https://youtu.be/0jZdM9peVSk SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Insecure Handling Of URI Schemes product: Microsoft OneDrive iOS App vulnerable version: 8.13 fixed...

CVE-2017-8060

Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call...

CVE-2017-8059

Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information username/password, in addition to the static authentication token if t...