Information disclosure

The Konigsleiten aka com.knigsleiten application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6951

The OneFile Ignite (uk.co.onefile.ignite) Android app, version 1.19, does not verify X.509 certificates from SSL servers, per CVE-2014-6951. This leads to MITM possible to spoof servers and exfiltrate data. Public records (NVD, CVE listings) confirm the vulnerability and its impact (partial confi...

CVE-2014-6946

The Re:kyu aka com.appzone619 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-2576: Undefined Security Weakness

plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPTSSLVERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle MITM attacks...

SSLv3 Padding Oracle On Downgraded Legacy Encryption Vulnerability (POODLE)

The remote host is affected by a man-in-the-middle MitM information disclosure vulnerability known as POODLE. The vulnerability is due to the way SSL 3.0 handles padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining CBC mode. MitM attackers can decrypt a...

CVE-2014-6938

The Apostilas musicais aka com.apostilas application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

F5 Networks BIG-IP : OpenSSL vulnerability (K15325)

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessio...

UBUNTU-CVE-2014-7202

streamengine.cpp in libzmq aka ZeroMQ/C++ 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request...

CVE-2014-6913

The Dive The World aka com.paperton.wl.divetheworld application 1.53 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6929

The AIHce 2014 aka com.coreapps.android.followme.aihce2014 application 6.1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6879

The Equifax Mobile aka com.equifax application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6881

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The PNC Virtual Wallet aka com.pnc.ecommerce.mobile.vw.android application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6861

The CVE-2014-6861 entry concerns the Terrarienbilder.com Forum Android app (version 3.8.20) which does not verify X.509 certificates from SSL servers. This enables MITM attackers to spoof servers and retrieve sensitive information via crafted certificates. The connected records confirm the affect...

CVE-2014-6883

CVE-2014-6883 affects the Android app CNNMoney Portfolio for stocks (com.cnn.portfolio) v1.0.2. The root cause is lack of X.509 certificate validation for SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The CVSS metrics indicate pa...

CVE-2014-6870

CVE-2014-6870 affects the BGEnergy (aka com.bluegrass.smartapps) Android app (version 1.153.0034). The vulnerability is that the app does not verify X.509 certificates from SSL servers, enabling man‑in‑the‑middle attackers to spoof servers and obtain sensitive information via a crafted certificat...

CVE-2014-6862

The ArtAcces aka cat.gencat.mobi.artacces application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6852

The LedLine.gr Official aka com.automon.ledline.gr application 1.4.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The DS file aka com.synology.DSfile application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6837

The CVE-2014-6837 entry concerns The Hillside (com.hillside.hermanus) Android app 1.1 that does not verify X.509 SSL certificates. The root cause is lack of server certificate verification, enabling man-in-the-middle attackers to spoof SSL servers and access sensitive information via crafted cert...