Session fixation

The Fashion Story: Neon 90's aka com.teamlava.fashionstory39 application 1.5.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Grandparenting is Great aka com.appgig.layout application 1.400 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Job MoBleeps aka com.wJobMoBleeps application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Identity aka com.magzter.identity application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7432

The CalculatorApp aka com.intuit.alm.testandroidapp application 4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7478

The CVE-2014-7478 entry concerns the nashaplaneta.su (com.wNashaPlaneta) Android application 1.02 that does not verify X.509 certificates from SSL servers. This validation flaw enables MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The connected docume...

CVE-2014-7375

CVE-2014-7375 affects the Android application Childcare (com.app_macchildcare.layout) version 1.399. The root cause is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7468

The CVE-2014-7468 entry affects the AG Klettern Odenwald Android app (version 1.2) and is caused by failing to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and access sensitive information via a crafted certificate. The description specifies...

CVE-2014-7378

The CVE-2014-7378 entry concerns the Jobranco (com.jobranco) Android app v1.1, which does not verify X.509 SSL certificates. This allows MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The vulnerability affects the app’s SSL certificate validation logic...

CVE-2014-7372

The CVE-2014-7372 entry applies to the Mr.Sausage Android app (package com.app_mrsausage.layout) version 1.301, which does not verify X.509 certificates when connecting to SSL servers. This certificate validation failure enables a man-in-the-middle to spoof servers and exfiltrate sensitive inform...

CVE-2014-7342

The CVE-2014-7342 entry affects the Android application Echo News (package com.solo.report) in version 1.10 (beta). The underlying issue is that the app does not verify X.509 certificates when connecting to SSL servers, enabling man-in-the-middle attackers to spoof servers and access sensitive in...

CVE-2014-7129

The CVE-2014-7129 entry affects the Argus Leader Print Edition app (com.argusleader.android.prod) version 6.7 for Android. The underlying issue is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive informati...

CVE-2014-7455

Affected software : Zoella Unofficial Android app (package com.automon.ay.zoella), version 1.4.0.5. Root cause : the implementation does not verify X.509 certificates from SSL servers, enabling MITM spoofing via crafted certificates. Impact : confidentiality, integrity, and possibly availability ...

CVE-2014-7102

The Car Insurance Quote Comparison aka com.seopa.quotezone application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7063

The Bikers Romagna aka com.bikers.romagna application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7092

The Ubooly aka com.ubooly.ubooly application 4.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Oracle Linux 6 / 7 : openssl (ELSA-2014-1652)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1652 advisory. - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV t...

Mac OS X Multiple Vulnerabilities (Security Update 2014-005) (POODLE) (Shellshock)

The remote host is running a version of Mac OS X 10.8 or 10.9 that does not have Security Update 2014-005 applied. This update contains several security-related fixes for the following issues : - A command injection vulnerability in GNU Bash known as Shellshock. The vulnerability is due to the...

CVE-2014-7027

The Esercizi per le donne aka com.rareartifact.eserciziperledonne6D5578C6 application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7031

The RedAtoms Three aka com.redatoms.mojodroid.tw.gp application 2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...