Information disclosure

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6861

The CVE-2014-6861 entry concerns the Terrarienbilder.com Forum Android app (version 3.8.20) which does not verify X.509 certificates from SSL servers. This enables MITM attackers to spoof servers and retrieve sensitive information via crafted certificates. The connected records confirm the affect...

CVE-2014-6883

CVE-2014-6883 affects the Android app CNNMoney Portfolio for stocks (com.cnn.portfolio) v1.0.2. The root cause is lack of X.509 certificate validation for SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The CVSS metrics indicate pa...

CVE-2014-6870

CVE-2014-6870 affects the BGEnergy (aka com.bluegrass.smartapps) Android app (version 1.153.0034). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and obtain sensitive information via a crafted certificat...

CVE-2014-6862

The ArtAcces aka cat.gencat.mobi.artacces application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6852

The LedLine.gr Official aka com.automon.ledline.gr application 1.4.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The DS file aka com.synology.DSfile application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6837

The CVE-2014-6837 entry concerns The Hillside (com.hillside.hermanus) Android app 1.1 that does not verify X.509 SSL certificates. The root cause is lack of server certificate verification, enabling man-in-the-middle attackers to spoof SSL servers and access sensitive information via crafted cert...

CVE-2014-6837

The Hillside aka com.hillside.hermanus application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6839

The Alma Corinthiana aka com.alma.corinthiana application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Gulf Credit Union aka FiMobile.Gulf application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6781

The Aloha Stadium - Hawaii aka com.stadium.aloha application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Investigation Tool aka gov.ca.post.lp.itool application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6776

The CVE-2014-6776 entry covers the Android app United Advantage NW Federal Cr (com.myappengine.uanwfcu) version 1.7, where the client fails to verify X.509 certificates from SSL servers. This root cause enables man-in-the-middle attackers to spoof servers and obtain sensitive information via craf...

CVE-2014-6800

The CVE-2014-6800 entry applies to the Bloom Township 206 (net.parentlink.bloom) Android app version 4.0.500. The vulnerability arises because the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive informatio...

CVE-2014-6749

The American Nurses Association aka com.dub.poweredbydub.assoc.ana application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Sucuri: Usage of HTTP for exporting graph data as images

Whenever a user of waf.sucuri.net exports his reports graph data as a png, an unencrypted request is sent over to export.highcharts.com. This enables a mitm-able attacker to sniff and|or replace exported image. Also, the whole practice of offloading potentially private user data to an unrelated...

CVE-2014-6740

The XD Forum aka com.tapatalk.xdforumcomforum application 3.9.17 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6747

The CVE-2014-6747 entry describes the Android SeeOn (com.seeon) application, version 4.0.7, as not verifying X.509 certificates when establishing SSL connections. This causes a trust/validation bypass that enables man-in-the-middle attackers to spoof servers and access sensitive information via a...

CVE-2014-6738

The CVE-2014-6738 entry concerns the Maccabi Tel Aviv Android app (com.monkeytech.maccabi) version 1.0, which does not verify X.509 certificates when communicating with SSL servers. The root cause is missing certificate validation, enabling man-in-the-middle attackers to spoof servers and access ...