Total
2503 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-7124 | 1 Consulo | 1 Ip Alarm | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The IP Alarm (aka com.cosesy.gadget.alarm) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2013-7033 | 1 Livezilla | 1 Livezilla | 2025-04-12 | 4.3 MEDIUM | N/A |
|
LiveZilla before 5.1.2.1 includes the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which might allow remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent cross-site scripting (XSS) attack.
|
|||||
| CVE-2014-7384 | 1 Userfriendlymedia | 1 Joe\'s Lawn Service | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Joe's Lawn Service (aka com.appexpress.joeslawnservice) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5766 | 1 Mobileeventguide | 1 Uber B2b | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Uber B2B (aka de.mobileeventguide.uberb2b) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-8564 | 4 Canonical, Gnu, Opensuse and 1 more | 7 Ubuntu Linux, Gnutls, Opensuse and 4 more | 2025-04-12 | 5.0 MEDIUM | N/A |
|
The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs.
|
|||||
| CVE-2014-6751 | 1 Grasshopper | 1 Grasshopper Beta | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Grasshopper Beta (aka com.grasshopper.dialer) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-1263 | 1 Apple | 1 Mac Os X | 2025-04-12 | 4.3 MEDIUM | N/A |
|
curl and libcurl 7.27.0 through 7.35.0, when using the SecureTransport/Darwinssl backend, as used in in Apple OS X 10.9.x before 10.9.2, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.
|
|||||
| CVE-2015-8867 | 2 Canonical, Php | 2 Ubuntu Linux, Php | 2025-04-12 | 5.0 MEDIUM | 7.5 HIGH |
|
The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
|
|||||
| CVE-2014-3436 | 1 Symantec | 2 Encryption Desktop, Pgp Desktop | 2025-04-12 | 5.0 MEDIUM | N/A |
|
Symantec Encryption Desktop 10.3.x before 10.3.2 MP3, and Symantec PGP Desktop 10.0.x through 10.2.x, allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted encrypted e-mail message that decompresses to a larger size.
|
|||||
| CVE-2014-7788 | 1 Best Free Giveaways Project | 1 Best Free Giveaways | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Best Free Giveaways (aka com.wIphone5GiveAways) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-4884 | 1 Conrad Hotel Project | 1 Conrad Hotel | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Conrad Hotel (aka com.wConradHotel) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5590 | 1 Snake Evolution Project | 1 Snake Evolution | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Snake Evolution (aka com.btwgames.snake) application 1.3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6919 | 1 Afsinc | 1 Metalcasting Newsstand | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Metalcasting Newsstand (aka air.com.yudu.ReaderAIR3017071) application 3.12.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-4899 | 1 Magzter | 1 Indian Cement Review | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Indian Cement Review (aka com.magzter.indiancementreview) application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6994 | 1 Atecea | 1 Atecea | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Atecea (aka com.atecea) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5799 | 1 Nonghyup | 1 Smart Card | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The smart.card (aka nh.smart.card) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-0017 | 1 Libssh | 1 Libssh | 2025-04-12 | 1.9 LOW | N/A |
|
The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.
|
|||||
| CVE-2014-5845 | 1 Thirdwire | 1 Strike Fighters Israel | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Strike Fighters Israel (aka com.thirdwire.strikefighters.mideast.android) application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5614 | 1 Etoolkit | 1 Love Collage - Photo Editor | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Love Collage - Photo Editor (aka com.etoolkit.lovecollage) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7019 | 1 Blynk | 1 Clarks Inn | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Clarks Inn (aka com.ClarksInn) application 3.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2013-0173 | 1 Theforeman | 1 Foreman | 2025-04-12 | 5.0 MEDIUM | N/A |
|
Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.
|
|||||
| CVE-2015-8281 | 1 Samsung | 1 Web Viewer | 2025-04-12 | 7.8 HIGH | 7.5 HIGH |
|
Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows attackers to bypass filesystem encryption via XOR calculations.
|
|||||
| CVE-2014-7568 | 1 Automon | 1 Marcus Butler Unofficial | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Marcus Butler Unofficial (aka com.automon.ay.marcus.butler) application 1.4.0.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5625 | 1 Gamegou | 1 Perfect Kick | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Perfect Kick (aka com.gamegou.PerfectKick.google) application 1.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6831 | 1 Hippostudio | 1 Hippo Studio | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Hippo Studio (aka com.appgreen.hippostudio) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-3302 | 1 Cisco | 1 Webex Meetings Server | 2025-04-12 | 5.8 MEDIUM | N/A |
|
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.
|
|||||
| CVE-2014-5545 | 1 Torrnad0 | 1 Sprint Jump | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Sprint jump (aka air.com.ilaz.appilas) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-3604 | 1 Not Yet Commons Ssl Project | 1 Not Yet Commons Ssl | 2025-04-12 | 6.8 MEDIUM | N/A |
|
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
|
|||||
| CVE-2014-6868 | 1 Synology | 1 Ds Audio | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The DS audio (aka com.synology.DSaudio) application 3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7752 | 1 Nasioc | 1 Nasioc | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The NASIOC (aka net.endoftime.android.forumrunner.nasioc) application 3.8.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7342 | 1 Echonewshk | 1 Echo News | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Echo News (aka com.solo.report) 1.10 application (beta) for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7791 | 1 Appsgeyser | 1 Backyard Wrestling | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5852 | 1 Withhive | 1 Kakao | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Kakao (aka com.com2us.tinypang.kakao.freefull2.google.global.android.common) application 2.11.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6916 | 1 Mama | 1 Mama.cn | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The mama.cn (aka cn.ziipin.mama.ui) application 1.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6862 | 1 Gencat | 1 Artacces | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The ArtAcces (aka cat.gencat.mobi.artacces) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5576 | 1 Avira | 1 Avira Secure Backup | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Avira Secure Backup (aka com.avira.avirabackup) application 1.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2013-6994 | 1 Opentext | 1 Exceed Ondemand | 2025-04-12 | 6.4 MEDIUM | N/A |
|
OpenText Exceed OnDemand (EoD) 8 transmits the session ID in cleartext, which allows remote attackers to perform session fixation attacks by sniffing the network.
|
|||||
| CVE-2014-7390 | 1 Tabtale | 1 Enchanted Fashion Crush | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Enchanted Fashion Crush (aka com.tabtale.springcrushbundleint) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7721 | 1 Flexymind | 1 President Clicker | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The President Clicker (aka com.flexymind.pclicker) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5952 | 1 Calarepasoftware | 1 E-dziennik | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The E-Dziennik (aka com.librus.dziennik) application 0.5.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||