Design/Logic Flaw

The Gravity Bounce aka net.toddm.gb application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The FIAT Forum aka com.tapatalk.fiatforumcom application 3.8.41 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6000

The FreshDirect aka com.freshdirect.android application 2.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6016

The CVE-2014-6016 entry concerns the Celluloid (com.eurisko.celluloid) Android app version 1.3, which does not verify X.509 certificates from SSL servers. This allows a man-in-the-middle attacker to spoof SSL servers and obtain sensitive information via a crafted certificate. The vulnerability is...

CVE-2014-5809

The Smart Browser aka smartbrowser.geniuscloud application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6016

The Celluloid aka com.eurisko.celluloid application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5981

CVE-2014-5981 affects the MoWeather Android app (com.moji.moweather) 1.40.05. Root cause: SSL X.509 certificate validation is not performed, enabling man‑in‑the‑middle with crafted certificates to obtain sensitive information. Exploit details or remediation/version patch information are not provi...

CVE-2014-5946

The forumhawaaworldcom aka com.tapatalk.forumhawaaworldcom application 3.4.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Flurv Chat aka com.flurv.android application 4.3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5940

The CVE-2014-5940 entry concerns the PocketPC.ch (com.tapatalk.pocketpcch) Android app v3.9.51 that does not verify X.509 certificates from SSL servers. This underlying flaw enables man-in-the-middle attackers to spoof legitimate servers and obtain sensitive information via a crafted certificate....

CVE-2014-5919

The SurDoc - 100GB+ FREE storage aka com.jd.surdoc application 1.3.4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Important: axis

Issue Overview: It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name CN field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. CVE-2014-3596 Affected Packages: axis Issu...

Moderate: Red Hat Security Advisory: nss and nspr security, bug fix, and enhancement update

Updated nss and nspr packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

CVE-2014-5899

The CVE-2014-5899 entry concerns the Nespresso Android app (com.nespresso.activities) version 2.4.1. The root cause is that the app does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via crafted certificates....

axis security update

0:1.2.1-7.5 - Fix MITM security vulnerability - Use GCJ friendly patch - Resolves: CVE-2014-3596 0:1.2.1-7.4 - Fix MITM security vulnerability - Resolves: CVE-2014-3596...

CVE-2014-5868

The Cisco Technical Support aka com.cisco.swtgandroid application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5874

The SplashID aka com.splashidandroid application 7.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5757

The Buy Tickets aka com.xcr.android.buytickets application 2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5708

The Best Racing/moto Games Ranking aka com.subapp.android.racing application 2.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Input validation

The Jewels & Diamonds aka mominis.GenericAndroid.JewelsandDiamonds application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...