SSL 3.0 MITM Attack

A vulnerability affecting most implementations of SSL 3.0 has been discovered that allows an attacker to decrypt some encrypted contents under certain conditions CVE-2014-3566. The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak...

PT-2014-8046

Name of the Vulnerable Software and Affected Versions The Translation Widget aka com.wTranslationGadget application version 0.1 Description The issue concerns a lack of verification of X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive...

CVE-2014-7620: Undefined Security Weakness

The Authors On Tour - Live! aka com.appmakr.app122286 application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Yahoo in China suffered a SSL man in the middle attacks-vulnerability warning-the black bar safety net

Latest update: Off 1 0 on 2 0 PM 1 6: 4 to 6 points, attacks still continue......... 2 0 1 4 years 1 0 month 2 0 Day 1 4:3 0, Yahoo in mainland China once again under SSL man in the middle attacks, the domestic three operators to access all there is a problem, and Hong Kong, the United States,...

PT-2014-8061

Name of the Vulnerable Software and Affected Versions com.app andersonmusaamil.layout version 1.400 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-8137

Name of the Vulnerable Software and Affected Versions The Physics Forums application version 3.9.22 Description The issue concerns the application's failure to verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

Palo Alto Networks PAN-OS < 5.0.14 / 5.1.x < 5.1.9 / 6.0.x < 6.0.4 OpenSSL MitM

The remote host is running a version of Palo Alto Networks PAN-OS prior to 5.0.14 / 5.1.9 / 6.0.4. It is, therefore, affected by a flaw in the included OpenSSL library that can cause the client or server to use weak keying material, which a remote attacker can exploit to conduct a man-in-the-midd...

CVE-2014-7456

The Digit Magazine aka com.magzter.digitmagazine application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7384

The Joe's Lawn Service aka com.appexpress.joeslawnservice application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7328

The brain abundance info aka com.wbrainabundance application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The IP Alarm aka com.cosesy.gadget.alarm application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Grandparenting is Great aka com.appgig.layout application 1.400 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Identity aka com.magzter.identity application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Craft Stamper Magazine aka com.triactivemedia.craftstamper application @7F080183 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Xxe

The DealSide Institutional aka com.magzter.dealsideinstitutional application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The ETG Hosting aka com.etg.web.hosting application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Alternative Connection aka com.wAlternativeConnection application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Suzanne Glathar aka com.appsglathar.layout application 1.399 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Job MoBleeps aka com.wJobMoBleeps application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Session fixation

The Fashion Story: Neon 90's aka com.teamlava.fashionstory39 application 1.5.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...