CVE-2014-5940

The CVE-2014-5940 entry concerns the PocketPC.ch (com.tapatalk.pocketpcch) Android app v3.9.51 that does not verify X.509 certificates from SSL servers. This underlying flaw enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate....

CVE-2014-5919

The SurDoc - 100GB+ FREE storage aka com.jd.surdoc application 1.3.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Important: axis

Issue Overview: It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name CN field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. CVE-2014-3596 Affected Packages: axis Issu...

Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

CVE-2014-5899

The CVE-2014-5899 entry concerns the Nespresso Android app (com.nespresso.activities) version 2.4.1. The root cause is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates....

axis security update

0:1.2.1-7.5 - Fix MITM security vulnerability - Use GCJ friendly patch - Resolves: CVE-2014-3596 0:1.2.1-7.4 - Fix MITM security vulnerability - Resolves: CVE-2014-3596...

CVE-2014-5868

The Cisco Technical Support aka com.cisco.swtgandroid application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5874

The SplashID aka com.splashidandroid application 7.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5757

The Buy Tickets aka com.xcr.android.buytickets application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5708

The Best Racing/moto Games Ranking aka com.subapp.android.racing application 2.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Word Search aka com.virtuesoft.wordsearch application 2.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Input validation

The Jewels & Diamonds aka mominis.GenericAndroid.JewelsandDiamonds application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5774

The Web Browser & Explorer aka internetexplorer.browser.webexplorer application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5737

The CVE-2014-5737 entry relates to the CDsoft (com.wCDSOFT) Android app version 0.2 failing to verify X.509 certificates from SSL servers. This creates susceptibility to man-in-the-middle attacks, enabling an attacker to spoof servers and access sensitive information via a crafted certificate. Co...

CVE-2014-5772

The Government Bookstore aka hksarg.isd.sop.govbookstore application 1.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5761

The Zipcar aka com.zc.android application 3.4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5800

The smart.nhibzbanking aka nh.smart.nhibzbanking application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5737

The CDsoft aka com.wCDSOFT application 0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5720

The Bike Race Free - Top Free Game aka com.topfreegames.bikeracefreeworld application 4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5793

The Bilgi Yarisi aka net.mobilecraft.bilgiyarisi application 1.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...