Information disclosure

The forumhawaaworldcom aka com.tapatalk.forumhawaaworldcom application 3.4.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Code injection

The Soccer Blitz aka soccer.blitz application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5945

The Edline Mobile aka com.wEdlineFree application 0.63.13369.34294 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-6917

Name of the Vulnerable Software and Affected Versions Vodafone Mobile@Work application version 6.0.0.1.12R Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates fr...

PT-2014-6931

Name of the Vulnerable Software and Affected Versions com.tapatalk.forumhawaaworldcom version 3.4.12 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL...

PT-2014-6460

Name of the Vulnerable Software and Affected Versions Schneider Electric StruxureWare SCADA Expert ClearSCADA versions 2010 R3 through 2014 R1 Description The issue concerns the use of the MD5 algorithm for an X.509 certificate, which can be exploited by remote attackers to spoof servers via a...

Information disclosure

The watcha aka com.frograms.watcha application 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5906

The Lil Wayne Slots: FREE SLOTS aka com.lilwayneslots.slots.android application 1.138 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Medium: libXext

Issue Overview: Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the 1 XcupGetReservedColormapEntries, 2 XcupStoreColors, 3 XdbeGetVisualInfo, 4 XeviGetVisualInfo, 5...

PT-2014-6903

Name of the Vulnerable Software and Affected Versions The Secret Circle - talk freely aka com.easyxapp.secret version 2.2.00.26 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify...

PT-2014-6901

Name of the Vulnerable Software and Affected Versions Minha Oi aka br.com.mobicare.minhaoi version 1.15.0 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates fro...

Important: jakarta-commons-httpclient

Issue Overview: Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service FPS merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

SNMP DDoS Attack Spoofs Google DNS Server

Update: The SANS Internet Storm Center this afternoon reported SNMP scans spoofed from Google’s public recursive DNS server seeking to overwhelm vulnerable routers and other devices that support the protocol with DDoS traffic. “The traffic is spoofed, and claims to come from Google’s DNS server...

CVE-2014-5890

The KBO sports2i 2014 aka com.sports2i application 5.1.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-6877

Name of the Vulnerable Software and Affected Versions com.show.greenbill G version 2.0.3 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate because the application does not verify X.509 certificates from SSL servers...

Cisco Patches Denial-of-Services Vulnerability in IMC

US-CERT today released an advisory warning of a vulnerability in Cisco’s Integrated Management Controller IMC. Cisco released an update that patches the security hole. The IMC is a baseboard management controller that oversees embedded servers inside Cisco Unified Computing System E-Series Blade...

CVE-2014-5866

The provided data confirms CVE-2014-5866 affects the CA DMV (gov.ca.dmv) application 2 for Android, where the app does not verify X.509 certificates from SSL servers. This lack of certificate verification enables man-in-the-middle attackers to spoof servers and obtain sensitive information via a ...

CVE-2014-5872

The SafeNetMobile Pass aka securecomputing.devices.android.controller application 8.3.7.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-6866

Name of the Vulnerable Software and Affected Versions Yahoo! Japan Box aka jp.co.yahoo.android.ybox version 1.5.1 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509...

PT-2014-6858

Name of the Vulnerable Software and Affected Versions Sears application version 6.2.8 Description The issue allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, as the application does not verify X.509 certificates from SSL servers...