Total
2503 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-6841 | 1 Rtiindia | 1 Rti India | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The RTI INDIA (aka com.vbulletin.build_890) application 3.8.21 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5917 | 1 Grassapper | 1 Slideshow 365 | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Slideshow 365 (aka com.Slideshow) application 3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6655 | 1 Exoticpetnetwork | 1 Tortoise Forum | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Tortoise Forum (aka org.tortoiseforum.android.forumrunner) application 3.5.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7023 | 1 Find Color Project | 1 Find Color | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Find Color (aka com.chudong.color) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6713 | 1 Medquiz\ | 1 Medical Chat And Mcqs Project | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The MedQuiz: Medical Chat and MCQs (aka com.pdevsmedd.med) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7441 | 1 Pakan Ken Tube Project | 1 Pakan Ken Tube | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Pakan Ken Tube (aka com.PakanKen) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6819 | 1 Lappgroup | 1 Lapp Group Catalogue | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Lapp Group Catalogue (aka com.prinovis.LappKabel) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6733 | 1 T-mobile | 1 My T-mobile | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The My T-Mobile (aka at.tmobile.android.myt) application @7F0C0030 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5527 | 1 Tapjoy | 1 Tapjoy Library | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Tapjoy library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6820 | 1 Amebra Ameba Project | 1 Amebra Ameba | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Amebra Ameba (aka jp.honeytrap15.amebra) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7538 | 1 Headlines News India Project | 1 Headlines News India | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Headlines news India (aka com.dreamstep.wHEADLINESNEWSINDIA) application 0.21.13219.95110 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7072 | 1 Offertaviaggi | 1 Venezia Map | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Venezia map (aka com.wVeneziamap) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2015-1571 | 1 Fortinet | 1 Fortios | 2025-04-12 | 4.3 MEDIUM | N/A |
|
The CAPWAP DTLS protocol implementation in Fortinet FortiOS 5.0 Patch 7 build 4457 uses the same certificate and private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the Fortinet_Factory certificate and private key. NOTE: FG-IR-15-002 says "The Fortinet_Factory certificate is unique to each device ... An attacker cannot therefore stage a MitM attack.
|
|||||
| CVE-2014-6925 | 1 Gcspublishing | 1 Steyr Forum | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Steyr Forum (aka com.tapatalk.steyrclubcomvb) application 3.9.12 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7450 | 1 Allnurses | 1 Allnurses | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The allnurses (aka com.tapatalk.allnursescom) application 3.4.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6011 | 1 Formnage | 1 Cutprice | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The cutprice (aka kr.co.wedoit.cutprice) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5900 | 1 Myhomeworkapp | 1 Myhomework Student Planner | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5853 | 1 Withive | 1 Knights N Squires | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Knights N Squires (aka com.com2us.imhero.normal.freefull.google.global.android.common) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-4448 | 1 Apple | 1 Iphone Os | 2025-04-12 | 1.9 LOW | N/A |
|
House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID.
|
|||||
| CVE-2014-7057 | 1 Magzter | 1 Hong Kong Tatler Society | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Hong Kong Tatler Society (aka com.magzter.hongkongtatlersociety) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2013-7385 | 1 Livezilla | 1 Livezilla | 2025-04-12 | 6.8 MEDIUM | N/A |
|
LiveZilla 5.1.2.1 and earlier includes the MD5 hash of the operator password in plaintext in Javascript code that is generated by lz/mobile/chat.php, which allows remote attackers to obtain sensitive information and gain privileges by accessing the loginName and loginPassword variables using an independent cross-site scripting (XSS) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7033.
|
|||||
| CVE-2016-8224 | 1 Lenovo | 57 Bios, Notebook 110 14ibr, Notebook 110 14ibr Bios and 54 more | 2025-04-12 | 4.6 MEDIUM | 4.4 MEDIUM |
|
A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Management Engine (ME) protections. This could result in a denial of service or privilege escalation attack on the system.
|
|||||
| CVE-2014-6016 | 1 Celluloidapp | 1 Celluloid | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Celluloid (aka com.eurisko.celluloid) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2015-0941 | 1 Inetc Project | 1 Inetc | 2025-04-12 | 4.3 MEDIUM | N/A |
|
The Inetc plugin for Nullsoft Scriptable Install System (NSIS), as used in CERT/CC Failure Observation Engine (FOE) and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a crafted certificate in a download session for Windows executable files.
|
|||||
| CVE-2016-6606 | 1 Phpmyadmin | 1 Phpmyadmin | 2025-04-12 | 5.0 MEDIUM | 8.1 HIGH |
|
An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the s ...
Show More |
|||||
| CVE-2014-7017 | 1 Tim Ban Bon Phuong Project | 1 Tim Ban Bon Phuong | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Tim Ban Bon Phuong (aka com.entertaiment.timbanbonphuong) application 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7336 | 1 Princetoncorporatesolutions | 1 Taking Your Company Public | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Taking Your Company Public (aka biz.app4mobile.app_016e43d03ee54d1facd6c9532a00e724.app) application 1.28.44.441 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5674 | 1 Picsart | 1 Picsart - Photo Studio | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The PicsArt - Photo Studio (aka com.picsart.studio) application 4.5.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6982 | 1 Arabic Troll Football Project | 1 Arabic Troll Football | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Arabic Troll Football (aka com.hamoosh.ArabicTrollFootball) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5694 | 1 Scoutmob | 1 Scoutmob Local Deals \& Event | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Scoutmob local deals & events (aka com.scoutmob.ile) application 3.0.18 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7509 | 1 Ireadercity | 1 A Very Short History Of Japan | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The A Very Short History of Japan (aka com.ireadercity.c51) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7631 | 1 Texasweddingmall | 1 Villa Antonia | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Villa Antonia (aka com.appbuilder.u7p5019) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5571 | 1 Appeak | 1 Poker | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Appeak Poker (aka com.appeak.poker) application 2.4.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7002 | 1 Goomeo | 1 Sopexa Pavillon France | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Sopexa Pavillon France (aka com.goomeoevents.pavillonfrance) application 3.6.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2015-1848 | 2 Fedora, Redhat | 5 Pacemaker Configuration System, Enterprise Linux High Availability, Enterprise Linux High Availability Eus and 2 more | 2025-04-12 | 6.8 MEDIUM | N/A |
|
The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
|
|||||
| CVE-2014-7519 | 1 Cyclingforfun | 1 Cycling Manager Game Cff | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Cycling Manager Game Cff (aka com.CyclingManagerGame) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7024 | 1 Pdlk | 1 Hardest Game Collection | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Hardest Game Collection (aka com.lotfun.abuse) application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-7117 | 1 Forestarea | 1 Forest Area Fcu Mobile | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Forest Area FCU Mobile (aka com.metova.cuae.fafcu) application 1.0.29 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-6976 | 1 Aeroexpress | 1 Aeroexpress | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The Aeroexpress (aka ru.lynx.aero) application 2.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||
| CVE-2014-5994 | 1 Ding | 1 Ding Ezetop. Top-up Any Phone | 2025-04-12 | 5.4 MEDIUM | N/A |
|
The ding* ezetop. Top-up Any Phone (aka com.ezetop.world) application 1.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
|
|||||