Design/Logic Flaw

The Coles Credit Card App aka au.com.colesfinancialservices.mobile application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5601

The CVE-2014-5601 issue affects the Android app 1800CONTACTS (com.contacts1800.ecomapp) version 2.7.0, where the app does not verify SSL/TLS X.509 certificates when establishing HTTPS connections. Root cause: missing/incorrect certificate validation logic allows MITM attackers to spoof servers an...

CVE-2014-5528

The Appsflyer library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5685

The Runtastic Heart Rate aka com.runtastic.android.heartrate.lite application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5569

The Star Girl aka com.animoca.google.starGirl application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5647

The CVE-2014-5647 entry concerns the ISL Light Remote Desktop Android app (com.islonline.isllight.mobile.android) version 2.1.0, which does not verify X.509 certificates from SSL servers. This lack of certificate validation enables man-in-the-middle attackers to spoof servers and access sensitive...

CVE-2014-5643

The CVE-2014-5643 entry concerns the Instachat – Instagram Messenger Android app (com.instachat.android), version 1.6.2. Root cause: the app does not verify X.509 certificates from SSL servers. Impact: enables man‑in‑the‑middle attackers to spoof servers and access sensitive information via a cra...

CVE-2014-5524

The Adcolony library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5590

The Snake Evolution aka com.btwgames.snake application 1.3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5691

The Best Phone Security aka com.rvappstudios.phonesecurity application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5541

The Hidden Memory - Aladdin FREE! aka air.com.differencegames.hmaladdinfree application 1.0.31 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5636

The Cloud Browser aka com.granitamalta.cloudbrowser application 2.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5674

CVE-2014-5674 affects the PicsArt Photo Studio Android app (com.picsart.studio), up to version 4.5.5, by not validating SSL certificates. The vulnerability enables MITM attackers to spoof servers and access sensitive data. Public sources describe the root cause as improper certificate validation,...

CVE-2014-5531

The Abode aka abode.webview application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5585

The CVE-2014-5585 entry applies to the Android app “Like4Like: Get Instagram Likes” (package com.bepop.bepop) version 2.1.5. Multiple connected sources confirm the root cause: the app does not verify X.509 certificates when establishing SSL/TLS connections, allowing MITM attackers to spoof server...

CVE-2014-5642

The IMPI Mobile Security aka com.impi application 2.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5576

The Avira Secure Backup aka com.avira.avirabackup application 1.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5683

The Piano Teacher aka com.rubycell.pianisthd application 20140730 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5556

The CVE-2014-5556 entry refers to the Fly Fishing & Fly Tying Android app (version 3.21.0, package air.com.yudu.ReaderAIR3209899) failing to verify X.509 certificates from SSL servers. This allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certific...

CVE-2014-5625

The Perfect Kick aka com.gamegou.PerfectKick.google application 1.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...