CVE-2014-6850

The SED Account aka com.starkville.smartapps application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The RTI INDIA aka com.vbulletin.build890 application 3.8.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6838

The Groupama toujours la aka com.groupama.toujoursla application 1.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Integer overflow

Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service crash and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow...

CVE-2014-6814

The Sentinels Randomizer aka com.mikehipps.sentinelsrandomizer application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The voetbal aka nl.jborsje.android.voetbal.az application 4.7.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The OHBM 20th Annual Meeting aka com.coreapps.android.followme.ohbm2014 application 6.0.9.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6828

The Gulf Credit Union aka FiMobile.Gulf application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6830

The Covet Fashion - Shopping Game aka com.crowdstar.covetfashion application 2.14.40 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7522

Name of the Vulnerable Software and Affected Versions MediaFire aka com.mediafire.android version 1.1.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates...

PT-2014-7497

Name of the Vulnerable Software and Affected Versions Amebra Ameba aka jp.honeytrap15.amebra version 1.0.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificate...

PT-2014-7501

Name of the Vulnerable Software and Affected Versions com.anek.kamkomesan version 1.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL servers...

PT-2014-7503

Name of the Vulnerable Software and Affected Versions Tic-Tac To The MAX FREE aka com.tothemax version 1.2 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates fr...

CVE-2013-2100

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

Code injection

Apache Axis2/C does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2012-6107

Axis2/C (Apache Axis2 in C) has a hostname verification flaw: it does not verify that the server hostname matches the CN or subjectAltName in the X.509 certificate, enabling MITM with any valid certificate. The PT-2014-2368 entry notes affected software as Apache Axis2 (C language Web services en...

CVE-2014-6787

The Counter Intuition aka com.counter.intuition application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-6774

The USEK aka com.university.usek application 1.0.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The CIH Quiz game aka com.bowenehs.cihquizgameapp application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The United Advantage NW Federal Cr aka com.myappengine.uanwfcu application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...