CVE-2014-6998

The PinkFong TV aka kr.co.smartstudy.pinkfongtvandroidgooglemarket application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7006

The HydFM aka com.apheliontechnologies.hydfm application 1.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7004

The PETA aka com.peta.android application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6970

The North American Ismaili Games aka hr.apps.n166983741 application 5.26.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Server side request forgery (ssrf)

The Hardest Game Collection aka com.lotfun.abuse application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6959

The QinCard aka com.haowan.qincard application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6998

The PinkFong TV aka kr.co.smartstudy.pinkfongtvandroidgooglemarket application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6968

CVE-2014-6968 affects the Android app Grandma’s Grotto (com.mobileappsuite.grandmasgrotto) version 1. The root cause is the app not verifying X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. The ...

CVE-2014-6976

CVE-2014-6976 affects the Android app Aeroexpress (aka ru.lynx.aero) version 2.6.2. The root cause is that the application does not verify X.509 certificates from SSL servers, allowing MITM attackers to spoof servers and obtain sensitive information via a crafted certificate. The vulnerability im...

CVE-2014-7010

The CVE-2014-7010 entry concerns the UTSA Mobile Android app (com.dub.app.utsa) version 1.4.21, which does not verify X.509 certificates from SSL servers. This flaw enables man-in-the-middle attackers to spoof servers and access sensitive information via a crafted certificate. The available conne...

CVE-2014-6996

The Martial Arts Battle Card aka com.tapenjoy.zjh.tw application 1.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7024

The Hardest Game Collection aka com.lotfun.abuse application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7041

The SimGene aka com.japanbioinformatics.simgene application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

OpenSSL Releases Patch for POODLE Attack

The OpenSSL Project has released a new version of the encryption software, which patches several security flaws, including the bug that is exploited by the POODLE attack on SSLv3. The updated versions of OpenSSL come just a couple of days after a trio of researchers at Google revealed the POODLE...

PT-2014-7712

Name of the Vulnerable Software and Affected Versions The Noble Sticker "FREE" aka com.kuronecostudio.kizokustamp.free version 1.0.7 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive...

PT-2014-7696

Name of the Vulnerable Software and Affected Versions The Leg Surgery - Kids Games aka com.harriskerioe.legsurgery version 1.0.2 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information...

PT-2014-7640

Name of the Vulnerable Software and Affected Versions Hanyang University Admissions aka kr.ac.hanyang.planner version 2.1.3 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a...

PT-2014-7632

Name of the Vulnerable Software and Affected Versions Hydrogen Water aka com.appzone628 version 1.0 Description The application does not verify X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

openssl security update

1.0.1e-30.2 - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SSL3 1.0.1e-30 - add ECC TLS extensions to DTLS 1119800 1.0.1e-29 - fix CVE-2014-3505...

PT-2014-7672

Name of the Vulnerable Software and Affected Versions The Martial Arts Battle Card aka com.tapenjoy.zjh.tw version 1.0.9 Description The application does not verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a...