CVE-2014-5798

The smart.calculator aka nh.smart.calculator application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5678

The IQ Test aka com.pophub.androidiqtest.free application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5662

The Rail Rush aka com.miniclip.railrush application 1.9.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5617

The Exsoul Web Browser aka com.exsoul application 3.3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5577

The AVON Buy & Sell aka com.AVONBeautyntheRep application 0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5572

The Jazzpodium De Tor aka com.appmakr.app273713 application 206160 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Ask.fm - Social Q&A Network aka com.askfm application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Avira Secure Backup aka com.avira.avirabackup application 1.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5622

The Follow Mania for Instagram aka com.followmania application 1.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5591

The Frankly Chat aka com.chatfrankly.android application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5600

The familyconnect aka com.comcast.plaxo.familyconnect.app application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5623

The penguinchefshop aka com.freegames.penguinchefshop application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5615

CVE-2014-5615 affects the Snap Secure app (com.exclaim.snapsecure.app) version 9.5 for Android, where SSL/TLS certificate verification is not performed. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates. The vulnerability details ar...

CVE-2014-5662

CVE-2014-5662 affects the Android app Rail Rush (com.miniclip.railrush) version 1.9.0. The vulnerability is due to the app not performing X.509 certificate validation for SSL servers, which enables man-in-the-middle attackers to spoof trusted servers and exfiltrate sensitive information via a cra...

CVE-2014-5555

The Counting & Addition Kids Games aka air.com.tribalnova.ilearnwith.ipad.PokoAddEn application 1.8.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5611

The CVE-2014-5611 entry concerns the Android app com.ebay.kleinanzeigen (Germany) version 5.0.2, which does not verify X.509 certificates from SSL servers. This creates a risk of MITM disclosure of sensitive information via crafted certificates. The available connected documents corroborate that ...

CVE-2014-5545

The CVE-2014-5545 entry documents a vulnerability in the Sprint jump (aka air.com.ilaz.appilas) Android app, where the application does not verify X.509 certificates from SSL servers. The underlying issue is missing certificate validation, which allows a man-in-the-middle attacker to spoof server...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...

jakarta-commons-httpclient security update

1:3.1-16 - Fix MITM security vulnerability - Resolves: CVE-2014-3577...

New Firefox 32 Adds Protection Against MiTM Attack and Rogue Certificates

Good news for Firefox lovers! The Mozilla Foundation has introduced a bunch of new features in Firefox to improve browser security with the launch of Firefox 32, now available for Windows, Mac, Linux, and Android platforms. The new version of Firefox makes the browser even more competitive among...