CVE Daily
← All tags

Tag: Mitm

All CVEs associated with "Mitm". Page 27/32 • 3809 CVEs.

Subscribe CVEs: RSS for “Mitm”  ·  RSS (High+Critical only)

About “Mitm”

A curated feed of “Mitm”-related CVEs appears below. We currently track 3809 CVEs for this tag (all time). In the last 365 days, 218 were published. Average CVSS is 6.1 (all time; 6.6 over 365d), and 25% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-295 - Improper Certificate Validation, CWE-319 - Cleartext Transmission of Sensitive Information, CWE-297 - Improper Validation of Certificate with Host Mismatch.

In our taxonomy this topic maps to a MODERATE impact class. Common exploitation patterns for this weakness can lead to moderate. Use the filters to triage high risk first and validate exposure in your environment. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0
2014-09-09
Medium

CVE-2014-5617

The Exsoul Web Browser (aka com.exsoul) application 3.3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiti…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5616

The Web Browser & Explorer (aka com.explore.web.browser) application 2.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers a…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5615

The Snap Secure (aka com.exclaim.snapsecure.app) application 9.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5614

The Love Collage - Photo Editor (aka com.etoolkit.lovecollage) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serve…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5613

The Able Remote (aka com.entertailion.android.remote) application 2.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5612

The Gmarket (aka com.ebay.kr.gmarket) application 5.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5611

The eBay Kleinanzeigen for Germany (aka com.ebay.kleinanzeigen) application 5.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof se…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5610

The ce4arab market (aka com.dreamstep.wce4arabmarket) application 0.12.13093.40460 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5609

The Stickman Ski Racer (aka com.djinnworks.StickmanSkiRacer.free) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof se…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5608

The Line Runner (Free) (aka com.djinnworks.linerunnerfree) application 4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5607

The Where's My Water? Free (aka com.disney.WMWLite) application 1.9.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5606

The Where's My Perry? Free (aka com.disney.WMPLite) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5605

The QQ Copy (aka com.digimobistudio.qqcopy) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiti…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5604

The Akinator the Genie FREE (aka com.digidust.elokence.akinator.freemium) application 2.46 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5603

The DeskRoll Remote Desktop (aka com.deskroll.client1) application 0.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and o…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5602

The Magzter -Magazine & Book Store (aka com.dci.magzter) application 3.31 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5601

The 1800CONTACTS App (aka com.contacts1800.ecomapp) application 2.7.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5600

The familyconnect (aka com.comcast.plaxo.familyconnect.app) application 1.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5599

The Tiny Farm (aka com.com2us.tinyfarm.normal.freefull.google.global.android.common) application 2.02.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middl…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5598

The Puzzle Family (aka com.com2us.puzzlefamily.up.freefull.google.global.android.common) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-mid…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5597

The 9 Innings: 2014 Pro Baseball (aka com.com2us.nipb2013.normal.freefull.google.global.android.common) application 4.0.3 for Android does not verify X.509 certificates from SSL servers, which allows…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5596

The Homerun Battle 2 (aka com.com2us.homerunbattle2.normal.freefull.google.global.android.common) application 1.2.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5595

The actionpuzzlefamily for Kakao (aka com.com2us.actionpuzzlefamily.kakao.freefull.google.global.android.common) application 1.4.3 for Android does not verify X.509 certificates from SSL servers, whi…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5594

The CIBC Mobile Banking (aka com.cibc.android.mobi) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obta…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5593

The Christian Dating Cafe (aka com.christiancafe.mobile.android) application 1.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5592

The Free Dating Heart COL (aka com.choiceoflove.dating) application 2.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5591

The Frankly Chat (aka com.chatfrankly.android) application 3.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5590

The Snake Evolution (aka com.btwgames.snake) application 1.3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain se…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5589

The Now Browser (Material) (aka com.browser.nowbasic) 2.8.1 application Material for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof ser…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5588

The Free eBooks (aka com.bmfapps.freekindlebooks) application 14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5587

The brokenscreencrank (aka com.biggame.brokenscreencrank) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5586

The BIATNET (aka com.biatnet.mobile) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive in…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5585

The Like4Like: Get Instagram Likes (aka com.bepop.bepop) application 2.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers a…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5584

The Background Check BeenVerified (aka com.beenverified.android) application 4.01.67 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5583

The Most Popular Ringtones (aka com.bbs.mostpopularringtones) application 32 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5582

The Ingress Intel Helper (aka com.bb.ingressintel) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtai…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5581

The mirror photo shape (aka com.baiwang.styleinstamirror) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5580

The BackgroundCheckProTool (aka com.BackgroundCheckProTool) application 3.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5579

The Anywhere Pad-Meet, Collaborate (aka com.azeus.anywherepad) application 4.0.1031 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5578

The Trading 212 FOREX (aka com.avuscapital.trading212) application before 2.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5577

The AVON Buy & Sell (aka com.AVONBeautyntheRep) application 0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5576

The Avira Secure Backup (aka com.avira.avirabackup) application 1.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5574

The Ask.fm - Social Q&A Network (aka com.askfm) application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5573

The Appstros - FREE Gift Cards! (aka com.appstros.main) application 1.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5572

The Jazzpodium De Tor (aka com.appmakr.app273713) application 206160 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obt…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5571

The Appeak Poker (aka com.appeak.poker) application 2.4.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiti…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5570

The DailyFinance - Stocks & News (aka com.aol.mobile.dailyFinance) application 2.0.2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5569

The Star Girl (aka com.animoca.google.starGirl) application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5568

The Las Vegas Lottery Scratch Off (aka com.androkera.lottery) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5567

The hasb_e_haal (aka com.anawaz.hasb_e_haal) application 1.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain se…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5566

The Selfshot - Front Flash Camera (aka com.americos.selfshot) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof server…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5565

The GadgetTrak Mobile Security (aka com.activetrak.android.app) application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5564

The Angry Gran Toss (aka com.aceviral.angrygrantoss) application 1.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and o…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5563

The Show do Milhao 2014 (aka br.com.lgrmobile.sdm) application 1.4.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obt…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5562

The Coles Credit Card App (aka au.com.colesfinancialservices.mobile) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5561

The Word Search Free (aka air.wordSearchFree) application 4.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sen…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5560

The Popscene (Music Industry Sim) (aka air.Popscene) application 1.04 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and ob…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5559

The Kids GoldFish Care (aka air.josiane.sauveterre.kidsgoldfishcare) application 1.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spo…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5558

The Hard Time (Prison Sim) (aka air.HardTime) application 1.111 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain s…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5557

The America's Economy for Phone (aka air.gov.census.mobile.phone.americaseconomy) application 1.5.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle att…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5556

The Fly Fishing & Fly Tying (aka air.com.yudu.ReaderAIR3209899) application 3.21.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5555

The Counting & Addition Kids Games (aka air.com.tribalnova.ilearnwith.ipad.PokoAddEn) application 1.8.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5554

The Fun Preschool Creativity Game (aka air.com.tribalnova.ilearnwith.ipad.MotherAppEn) application 1.6.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middl…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5553

The Kids Preschool Learning Games (aka air.com.tribalnova.ilearnwith.ipad.App3En) application 1.3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle att…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5552

The Numbers & Addition! Math games (aka air.com.tribalnova.ilearnwith.ipad.App2En) application 1.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5551

The Alphabet & Spelling Kids Games (aka air.com.tribalnova.ilearnwith.ipad.App1En) application 1.4.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5550

The Animals! Kids Preschool Games (aka air.com.tribalnova.Animals) application 1.6.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5549

The Puppy Slots (aka air.com.starluxstudios.PuppySlotsFree) application 3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers an…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5548

The Christmas Words (aka air.com.sevenBulls.summerWords) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers a…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5547

The Mahjong Galaxy Space Lite (aka air.com.permadi.mahjongIris) application 2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serv…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5546

The Africa Memory (aka air.com.klon4enabor4e.AfricaMemory) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5545

The Sprint jump (aka air.com.ilaz.appilas) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitiv…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5544

The SongPop (aka air.com.freshplanet.games.WaM) application 1.21.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtai…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5543

The Hidden Object - Alice Free (aka air.com.differencegames.hovisionsofalicefree) application 1.0.17 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle at…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5542

The Hidden Object Mystery (aka air.com.differencegames.hodetectivemysteryfree) application 1.0.65 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attac…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5541

The Hidden Memory - Aladdin FREE! (aka air.com.differencegames.hmaladdinfree) application 1.0.31 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5540

The Flick a Trade (aka air.com.cygnecode.fat) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sen…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5539

The Michael Baker FCU (aka air.com.creditunionhomebanking.mb155) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof s…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5538

The Westmoreland Water FCU (aka air.com.creditunionhomebanking.mb115) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sp…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5537

The Abduction Stacker Free (aka air.com.chewygames.abductionstacker2) application 1.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sp…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5536

The Bingo Bash - Free Bingo Casino (aka air.com.bitrhymes.bingo) application 1.31.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5535

The Baby Get Up - Kids Care (aka air.brown.jordansa.getup) application 1.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5534

The Princess Shopping (aka air.android.PrincessShopping) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and o…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5532

The Honolulu (aka adidas.jp.android.running.honolulu) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obta…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5531

The Abode (aka abode.webview) application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive informati…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5529

The Gameloft library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certific…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5528

The Appsflyer library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifi…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5527

The Tapjoy library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificat…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5526

The Inmobi library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificat…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5525

The MoMinis library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certifica…

CVSS: 5.4 CWE: CWE-310 View on NVD
Medium

CVE-2014-5524

The Adcolony library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certific…

CVSS: 5.4 CWE: CWE-310 View on NVD
2014-09-04
Medium

CVE-2012-6153

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltNa…

CVSS: 4.3 CWE: CWE-20 - Improper Input Validation View on NVD
2014-08-30
Medium

CVE-2014-3908

The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive informat…

CVSS: 5.8 CWE: CWE-310 View on NVD
2014-08-27
Medium

CVE-2014-3596

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certif…

CVSS: 5.8 CWE: N/A View on NVD
2014-08-21
Medium

CVE-2014-3577

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in…

CVSS: 5.8 CWE: N/A View on NVD
2014-08-20
Medium

CVE-2014-4749

IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file, which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key.

CVSS: 4.3 CWE: CWE-264 View on NVD
2014-08-19
Medium

CVE-2014-3522

The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certif…

CVSS: 4.0 CWE: CWE-297 - Improper Validation of Certificate with Host Mismatch View on NVD
Medium

CVE-2014-3504

The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in t…

CVSS: 4.0 CWE: N/A View on NVD
2014-08-16
Medium

CVE-2013-7144

LINE 3.2.1.83 and earlier on Windows and 3.2.1 and earlier on OS X does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive…

CVSS: 4.3 CWE: CWE-310 View on NVD
2014-08-15
Medium

CVE-2014-3902

The CyberAgent Ameba application 3.x and 4.x before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiti…

CVSS: 5.8 CWE: CWE-310 View on NVD
2014-08-14
Medium

CVE-2014-5239

The Microsoft Outlook.com application before 7.8.2.12.49.7090 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sen…

CVSS: 4.0 CWE: CWE-310 View on NVD
2014-08-13
Medium

CVE-2014-3511

The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in comm…

CVSS: 4.3 CWE: N/A View on NVD
2014-07-29
Low

CVE-2014-2226

Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.

CVSS: 2.6 CWE: CWE-255 View on NVD
2014-07-23
Medium

CVE-2014-4503

The parse_notify function in util.c in sgminer before 4.2.2 and cgminer 3.3.0 through 4.0.1 allows man-in-the-middle attackers to cause a denial of service (application exit) via a crafted (1) bbvers…

CVSS: 4.3 CWE: CWE-20 - Improper Input Validation View on NVD
2014-07-01
Medium

CVE-2014-3494

kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive in…

CVSS: 4.3 CWE: CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor View on NVD
2014-06-19
Medium

CVE-2014-2001

The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive inf…

CVSS: 5.8 CWE: CWE-310 View on NVD
2014-06-17
Medium

CVE-2014-0478

APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.

CVSS: 4.0 CWE: CWE-20 - Improper Input Validation View on NVD
2014-06-11
Medium

CVE-2014-1771

SChannel in Microsoft Internet Explorer 6 through 11 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which allows man-in-the-middle…

CVSS: 6.8 CWE: CWE-310 View on NVD
Medium

CVE-2014-0296

The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly encrypt sessions, which makes it easier for…

CVSS: 5.1 CWE: CWE-310 View on NVD
2014-06-06
Medium

CVE-2012-5583

phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle a…

CVSS: 5.8 CWE: CWE-310 View on NVD
2014-06-05
High

CVE-2014-0224

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a z…

CVSS: 7.4 CWE: CWE-326 - Inadequate Encryption Strength View on NVD
2014-06-02
Medium

CVE-2014-0042

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded pa…

CVSS: 4.3 CWE: CWE-310 View on NVD
Medium

CVE-2014-0041

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows m…

CVSS: 4.3 CWE: CWE-310 View on NVD
Medium

CVE-2014-0040

OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, whi…

CVSS: 4.3 CWE: N/A View on NVD
2014-05-29
Medium

CVE-2013-2193

Apache HBase 0.92.x before 0.92.3 and 0.94.x before 0.94.9, when the Kerberos features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive inf…

CVSS: 4.3 CWE: CWE-287 - Improper Authentication View on NVD
2014-05-27
Medium

CVE-2012-5662

x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-midd…

CVSS: 5.8 CWE: CWE-310 View on NVD
2014-05-26
Medium

CVE-2013-3046

The Meeting Server in IBM Sametime 8.x through 8.5.2.1 and 9.x through 9.0.0.1 does not send the HSTS Strict-Transport-Security header, which makes it easier for man-in-the-middle attackers to hijack…

CVSS: 4.3 CWE: CWE-287 - Improper Authentication View on NVD
Medium

CVE-2014-3274

Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established, which allows man-in-the-middle attackers to obtain sensitive directory inf…

CVSS: 4.3 CWE: CWE-310 View on NVD
2014-05-23
Medium

CVE-2013-0289

Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-midd…

CVSS: 4.3 CWE: CWE-310 View on NVD
2014-05-19
Medium

CVE-2013-6807

The client in OpenText Exceed OnDemand (EoD) 8 supports anonymous ciphers by default, which allows man-in-the-middle attackers to bypass server certificate validation, redirect a connection, and obta…

CVSS: 6.8 CWE: CWE-310 View on NVD