The EyeXam (aka com.globaleyeventures.eyexam) application 1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Abram Radio Groove! (aka com.nobexinc.wls_79226887.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Fermononrespiri Mobile (aka com.tapatalk.rmonlineitforums) application 3.8.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The 30A (aka com.app30a) application 5.26.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mark's Daily Apple Forum (aka com.tapatalk.marksdailyapplecomforum) application 2.4.9.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Timeless Black (aka com.apptive.android.apps.timeless) application 2.10.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

eLearn

(aka

com.desire2learn.campuslife.chattanoogastate.edu.directory)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The klassens (aka com.mcreda.klassens.apps) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mostafa Shemeas (aka com.mostafa.shemeas.website) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Oman News (aka com.oman.news.rmtzlnbuooordciw) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Aprende

a

Meditar

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The $0.99 Kindle Books (aka com.kindle.books.for99) application 6.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TradeHero (aka com.tradehero.th) application 2.2.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The barcode scanner (aka tw.com.books.android.plus) application 2.3.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Nerdico (aka com.nerdico.danielepais) application 1.9 Stable for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Re:kyu (aka com.appzone619) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Candy

Girl

Party

Makeover

(aka

com.bearhugmedia.android_candygirlparty)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Cart App (aka com.virtecha.mobilewallet) application 1.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Pregnancy

Tips

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Westpac Mobile Banking (aka org.westpac.bank) application 5.21 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The drareym (aka com.drareym) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Pocket Cam Photo Editor (aka mobi.pocketcam.editor) application 3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The INVEX (aka com.mobilatolye.keyinternet) application 1.0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The My Wedding Planner (aka app.wedding) application 1.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Metro News (aka com.netpia.ha.metro) application 1.6.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Hogs Fly Crazy (aka com.pedrojayme.hogsflycrazy) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The racemotocross (aka com.bossappsmk.racemotocross) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The phonearabs4 (aka com.phonearabs4.myapps) application 1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Boopsie MyLibrary (aka com.bredir.boopsie.mylibrary) application 4.5.110 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The GEMAIRE's HVAC Assist (aka com.es.Gemaire) application 5.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Vector Outage Manager (aka nz.co.vector.outagemanager) application 1.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Ford Credit Account Manager (aka com.fordcredit.accountmanager) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Tic-Tac To The MAX FREE (aka com.tothemax) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Alisha Marie (Unofficial) (aka com.automon.ay.alisha.marie) application 1.4.0.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Kingsoft Clip (Office Tool) (aka cn.wps.clip) application 1.5.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Coca-Cola FM Peru (aka com.enyetech.radio.coca_cola.fm_pe) application 2.0.41716 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Apostilas musicais (aka com.apostilas) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Care4Kids (aka com.codetherapy.care4kids) application 1.03 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Cove (aka org.covechurch.app) application 1.0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The global beauty research (aka com.appems.topgirl) application 1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

No

Fuss

Home

Loans

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The diziturky HD 2015 (aka com.adv.diziturky) application 2014 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Woodforest Mobile Banking (aka com.woodforest) application 3.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Addis Gag Funny Amharic Pic (aka com.wAmharicFunnyPicture) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The 7Sage LSAT Prep - Proctor (aka com.sevensage.lsat) application 2.1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Arabic Troll Football (aka com.hamoosh.ArabicTrollFootball) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The EPL Hat Trick (aka com.hat.trick.goal) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Wizaz Forum (aka com.tapatalk.wizazplforum) application 3.6.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The FreshDirect (aka com.freshdirect.android) application 2.7.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The AAPLD (aka com.bredir.boopsie.aapld) application 4.5.110 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ABC Song (aka com.tabtale.abcsingalong) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Canal 44 (aka com.canal.canal44) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Daum Maps - Subway (aka net.daum.android.map) application 3.9.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Anaheim Library 2Go! (aka com.bredir.boopsie.anaheim) application 4.5.110 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Aeroexpress (aka ru.lynx.aero) application 2.6.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Aloha Guide (aka com.aloha.guide.english) application 1.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Harem Thief Dating (aka com.haremthief.haremthief) application 1.2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Grasshopper Beta (aka com.grasshopper.dialer) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The PNC Virtual Wallet (aka com.pnc.ecommerce.mobile.vw.android) application before 2.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The kuailecaidengmi (aka com.licai.kuailecaidengmi) application 1.7.12.15 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Archie Comics (aka com.iversecomics.archie.android) application 1.07 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Morocco Weather (aka com.mobilesoft.meteomaroc) application 3.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DS audio (aka com.synology.DSaudio) application 3.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mass Gaming TV (aka net.massgamers) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The My T-Mobile (aka at.tmobile.android.myt) application @7F0C0030 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Leadership Newspapers (aka com.LeadershipNewspapers) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Goat Forum (aka com.gcspublishing.goatspot) application 3.9.15 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Angel

Reigns

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The RTI INDIA (aka com.vbulletin.build_890) application 3.8.21 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Steyr Forum (aka com.tapatalk.steyrclubcomvb) application 3.9.12 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Survey.com Mobile (aka com.survey.android) application 3.2.16 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Houcine El Jasmi (aka com.devkhr31.houcineeljasmi) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The BGEnergy (aka com.bluegrass.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Jazeera Airways (aka com.winit.jazeeraairways) application 2.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The American Nurses Association (aka com.dub.poweredbydub.assoc.ana) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Baglamukhi (aka com.wshribaglamukhiblog) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

StarSat

International

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The SDN Forum (TapaTalk) (aka com.tapatalk.forumshiftdeletenet) application 3.6.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Academy Sports + Outdoors Visa (aka com.usbank.icsmobile.academysports) application 1.18 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Forum IC (aka com.tapatalk.forumimmigrercom) application 3.3.12 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DK ONLINE Beta (aka com.sgmobile.dkonline) application 1.0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Konigsleiten (aka com.knigsleiten) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Juiker (aka org.itri) application 3.2.0829.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The psychology (aka com.alek.psychology) application 1.0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Kazakhstan Radio (aka com.wordbox.kazakhstanRadio) application 2.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The WISDOM (aka lvtu99.com.nescmxiaoniuniu) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Sketch W Friends FREE -Tablets (aka air.com.xlabz.SketchWFriendsFree) application 5.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Assyrian (aka com.b2.assyrian.activity) application 2.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

MemorizeIt!

(aka

com.kshinenterprises.kshinent.memorizeit)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The ModSim Connected (aka com.concursive.modsim) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Forum Krstarice (aka com.tapatalk.forumkrstaricacom) application 3.5.14 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Embry-Riddle (aka com.dub.app.erau) application 1.4.04 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The NBE (aka com.nbe.app) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Ultimate Target-Armored Sniper (aka air.wood.liame.ultimatetarget) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Afghan Radio (aka com.wordbox.afghanRadio) application 2.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Beekeeping Forum (aka com.tapatalk.supporttapatalkcomxxxxx) application 3.9.15 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MediaFire (aka com.mediafire.android) application 1.1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Buckhorn Grill (aka com.orderingapps.buckhorn) application 2.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The gewara (aka com.gewara) application 5.2.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Aerospace Jobs (aka com.app_aerospacejobs.layout) application 1.399 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The West Bend School District (aka net.parentlink.westbend) application 4.0.500 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

First

Assembly

NLR

(aka

com.subsplash.thechurchapp.firstassemblynlr)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Investigation Tool (aka gov.ca.post.lp.itool) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The RBFCU Mobile (aka com.Vertifi.DeposZip.P314089681) application 3.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The wSaudichannelAlNasr (aka com.wSaudichannelAlNasr) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The AuctionTrac Dealer (aka com.adesa.dealer.phone) application 2.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The scottcolibmn (aka com.bredir.boopsie.scottlib) application 4.5.110 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Vodafone Avantaj Cepte (aka com.vodafone.avantajcepte.main) application 1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The John MacArthur (aka com.john.macarthur) application 1.0.26 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The New Beginnings CFC (aka com.goodbarber.nbcfc) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ColorMania - Color Quiz Game (aka com.ColormaniaColoringGames) application 1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Aloha Stadium - Hawaii (aka com.stadium.aloha) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TuCarro (aka com.tucarro) application 2.0.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Anywhere Anytime Yoga Workout (aka com.bayart.yoga) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Comics Plus (aka com.iversecomics.comicsplus.android) application 1.06 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ElForro.com (aka com.tapatalk.elforrocom) application 2.4.3.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Dino Village (aka com.tappocket.dinovillage) application 1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Exercitii

pentru

abdomen

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Airlines International (aka org.iata.IAMagazine) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Downton Abbey Fan Portal (aka com.downton.abbey.fan.portal) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The GunBroker.com (aka com.gunbroker.android) application 1.1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Safe Browser - The Web Filter (aka com.cloudacl) application 1.2.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Trial Tracker (aka com.etcweb.android.trial_tracker) application 1.1.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Flurry library before 3.4.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Open Electrical Webser (aka com.wOpenElectricalWeb) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Hillside (aka com.hillside.hermanus) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

AFTERLIFE

WITH

ARCHIE

(aka

com.afterlifewitharchie.afterlifewitharchie)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Bikers Underground (aka hr.ap.n66871172) application 4.5.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Throne Rush (aka com.progrestar.bft) application 2.3.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Family Location (aka com.sosocome.family) application 3.4 2014-5-20 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The USEK (aka com.university.usek) application 1.0.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Zombie Detector (aka com.jimmybolstad.zombiedetector) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

AIHce

(aka

com.coreapps.android.followme.aihce2014)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Elk Grove PublicStuff (aka com.wassabi.elkgrove) application 3.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Thanodi - Setswana Translator (aka com.thanodi.thanodi) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

TIO

MobilePay

Bill

Payments

(aka

com.tionetworks.mobile.android.tioclient)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Friendcaster (aka uk.co.senab.blueNotifyFree) application 5.4.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The fastin (aka moda.azyae.fastin.net) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

EAGE

Amsterdam

(aka

com.coreapps.android.followme.eage_2014)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Forest River Forums (aka com.socialknowledge.forestriverforums) application 3.7.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Fuel Rewards Network (aka com.excentus.frn) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Long (aka com.imop.longjiang.android) application 1.0.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Treves

Dance

Center

(aka

com.myapphone.android.myapptrvesdancecenter)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Renny McLean Ministries (aka com.subsplash.thechurchapp.s_GJQX72) application 2.8.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The cutprice (aka kr.co.wedoit.cutprice) application 1.0.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mikeius (Official App) (aka com.automon.mikeius) application 1.4.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The FIAT Forum (aka com.tapatalk.fiatforumcom) application 3.8.41 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Codeeta Coupons (aka com.codeeta.promos) application 1.0.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Grilling with Rich (aka com.grilling.with.rich) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The bongomovie (aka com.mbwasi.bongomovie) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MifaShow Hairstyles (aka com.mifashow) application 3.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

RIMS

Annual

Conference

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The voetbal (aka nl.jborsje.android.voetbal.az) application 4.7.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Neeku Naaku Dash Dash (aka com.dakshaa.nndd) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Wedding Photo Frames-Love Pics (aka com.WeddingPhotoFramesLovePics) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The sunnat e rasool (aka com.imsoft.sunnat_e_rasool) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Facebook Facts (aka com.wFacebookFacts) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CNNMoney Portfolio for stocks (aka com.cnn.portfolio) application 1.0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The My Mobile Day (aka com.mymobileday) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The LikeHero Get Instagram Likes (aka com.fraoula.likehero) application 1.0.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Arch Friend (aka com.xyproto.archfriend) application 0.4.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Sweatshop (aka com.orderingapps.sweatshop) application 2.96 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Myanmar Housing : mmHome (aka com.mmhome3) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Active 24 (aka com.zentity.app.active24) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Georgia Packing (aka com.tapatalk.georgiapackingorg) application 3.9.16 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Alfa-Bank (aka ru.alfabank.mobile.android) application 5.5.1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Tortoise Forum (aka org.tortoiseforum.android.forumrunner) application 3.5.16 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Latin Angels Music HD (aka com.applizards.lafreetj) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The NBA Game Time 2013-2014 (aka com.nbadigital.gametimelite) application 4.11 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Alma Corinthiana (aka com.alma.corinthiana) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The mama.cn (aka cn.ziipin.mama.ui) application 1.02 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TTNET Muzik (aka com.ttnet.muzik) application 3.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Teatro Franco Parenti (aka com.mintlab.mx.teatroparenti) application 1.4.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The NOS Alive (aka pt.optimus.optimusalive2011) application 5.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The UC Browser HD (aka com.uc.browser.hd) application 3.3.1.469 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Algeria Radio (aka com.wordbox.algeriaRadio) application 2.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Koran - AlqoranVideos (aka com.alqoran.videos.example) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The EXPRESS (aka com.gpshopper.express.android) application 2.5.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Afro-Beat (aka com.zero.themelock.tambourine) application 0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MyBroadband Tapatalk (aka com.tapatalk.mybroadbandcozavb) application 3.9.22 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Questoes OAB (aka com.pedefeijao.questoesoab) application oab_android_1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The North American Ismaili Games (aka hr.apps.n166983741) application 5.26.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Sentinels Randomizer (aka com.mikehipps.sentinelsrandomizer) application 1.1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Koleksi Hadis Nabi SAW (aka com.wKoleksiHadisNabiSAW) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Utah Jazz (aka com.sportinginnovations.jazz) application 2.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The IRA's 59th Annual Conference (aka com.coreapps.android.followme.ira_14) application 6.0.7.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The American Express Serve (aka com.serve.mobile) application @7F0901E4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The JW Cards (aka com.jingwei.card) application 3.8.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The QinCard (aka com.haowan.qincard) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Belas Frases de Amor (aka com.goodbarber.frasesdeamor) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Grandma's Grotto (aka com.mobileappsuite.grandmasgrotto) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Abu Ali Anasheeds (aka com.faapps.abuali_anasheeds) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Horoscopes and Dreams (aka com.horoscopesanddreams) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Dubrovnik Guided Walking Tours (aka com.mytoursapp.android.app351) application 1.3.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Taiwan Business Bank (aka com.mitake.TBB) application 2.04 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

imagine

Next

bmobile

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The

Planet

of

the

Vapes

Forum

(aka

com.tapatalk.planetofthevapescoukforums)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Hanyang University Admissions (aka kr.ac.hanyang.planner) application 2.1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Bloom Township 206 (aka net.parentlink.bloom) application 4.0.500 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The United Educational CU (aka com.metova.cuae.uecu) application 1.0.27 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Well-Being Connect Mobile (aka com.healthways.wellbeinggo) application 2.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Sporting Club Uphoria (aka com.sportinginnovations.skc) application 2.1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Pushpins Grocery Coupons (aka com.pushpinsapp.pushpins) application 1.56 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Hearsay: A Social Party Game (aka air.com.lip.per) application 1.7.000 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Tsushima Travel Guide (aka com.netjapan.ntsushima) application 1.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Hippo Studio (aka com.appgreen.hippostudio) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Le Grand Bleu (aka com.appzone468) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Pharmaguideline (aka com.pharmaguideline) application 1.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Batch library for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The adidas eyewear (aka com.adidasep.eyewear) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Doodle Drop (aka net.lazyer.DoodleDrop) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

OHBM

Annual

Meeting

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Foxit MobilePDF - PDF Reader (aka com.foxit.mobile.pdf.lite) application 2.2.0.0616 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The China CITIC Bank Credit Card (aka com.citiccard.mobilebank) application 3.3.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Campus Link - Campus TV HKUSU (aka com.campus.tv.hkusu) application 2.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Loli Chocolate Cake (aka com.alison.kang.chocolatecake) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ArtAcces (aka cat.gencat.mobi.artacces) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Hook (aka com.hook.android) application 0.9.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Amazighmusic (aka nl.appsandroo.Amazighmusic) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Chifro Kids Coloring Game (aka com.chifro.kids_coloring_game) application 1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Skyrim Map (aka com.neko.skyrimmap) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SeeOn (aka com.seeon) application 4.0.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The African Radios Live (aka com.nana.africanradioslive) application 1.0.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mahabharata Audiocast (aka com.wordbox.mahabharataAudiocast) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Herbal Guide (aka com.pocket.herbal.guide) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The OneFile Ignite (aka uk.co.onefile.ignite) application 1.19 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Multitrac (aka com.multitrac) application 1.04 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Deschutes Public MobileLibrary (aka com.bredir.boopsie.deschutes) application 4.5.110 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Germanwings (aka com.germanwings.android) application 2.1.13 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Defence.pk (aka com.tapatalk.defencepkforums) application 2.4.13.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The United Advantage NW Federal Cr (aka com.myappengine.uanwfcu) application 1.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Versent Books (aka com.versentbooks) application 1.1.99 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Akne

Ernahrung

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Weather Channel (aka com.weather.Weather) application 5.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Anjuke (aka com.anjuke.android.app) application 7.1.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The HomeAdvisor Mobile (aka com.servicemagic.consumer) application 3.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

SingaporeMotherhood

Forum

(aka

com.tapatalk.singaporemotherhoodcomforum)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The WebMD (aka com.webmd.android) application 3.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SchoolXM (aka apprentice.schoolxm) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Homesteading Today (aka com.tapatalk.homesteadingtodaycom) application 3.7.14 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The LiveAuctions.tv (aka air.LiveAndroidMaxx) application 2.005 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The nuSquare (aka tw.com.nuphoto.nusquare) application 1.0.78 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Car Wallpapers HD (aka com.arab4x4.gallery.app) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Toraware Takojyou (aka ltd.pte.wavea.torawaretakojyou) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Counter Intuition (aka com.counter.intuition) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Karim

Rahal

Essoulami

(aka

com.karim.rahal.essoulami.lcxogeyuizteegxvnq)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The FAZ.NET (aka net.faz.FAZ) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The frank matano (aka com.frank.matano) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Maccabi Tel Aviv (aka com.monkeytech.maccabi) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CIH Quiz game (aka com.bowenehs.cihquizgameapp) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The kalahari.com Shopping (aka com.kalahari.shop) application 1.4.2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The All around Cyprus (aka com.cyprus.newspapers) application 2.11 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TechRadar News (aka com.techradar.news) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MOL bringaPONT (aka hu.mol.bringapont) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Covet Fashion - Shopping Game (aka com.crowdstar.covetfashion) application 2.14.40 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Deer Hunting Calls + Guide (aka com.anawaz.deerhuntingcalls.free) application 4.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Pesca de Carpa Lite (aka com.clearfishing.pescadecarpa.lite) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Atecea (aka com.atecea) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The LedLine.gr Official (aka com.automon.ledline.gr) application 1.4.0.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The IDS 2013 (aka de.mobileeventguide.ids2013) application 1.21 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Abraham Tours (aka com.mytoursapp.android.app432) application 1.1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Lapp Group Catalogue (aka com.prinovis.LappKabel) application 1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Celluloid (aka com.eurisko.celluloid) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Gulf Credit Union (aka Fi_Mobile.Gulf) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Rakuten Install (aka co.jp.rakuten.installapp) application 1.5.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mootorratturid & biker.ee (aka ee.digitalfruit.mootorratturid) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 might allow man-in-the-middle attackers to obtain sensitive information by leveraging an unencrypted connection for interfaces. IBM X-Force ID: 96172.


The Ruta Exacta (aka com.rutaexacta.m) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ABC Lounge Webradio (aka com.nobexinc.wls_66087017.rc) application 3.3.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Inside Crochet (aka com.magazinecloner.insidecrochet) application @7F08017A for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Yik Yak (aka com.yik.yak) application 2.0.002 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Infiniti Roadside Assistance (aka com.ccas.rsa.common.infiniti) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The superheroquiz (aka com.davidhey.superheroquiz) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Instaroid - Instagram Viewer (aka net.muik.instaroid) application 1.2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Mt.

Airy

News

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The SudaniNet (aka com.sudaninet.wtwqiqbegq_btwlda) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The weibo (aka magic.weibo) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The blueeleph (aka eg.film.blueeleph) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Quotes in Images (aka pt.lumberapps.imagensfrases) application 3.7.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Apploi Job Search- Find Jobs (aka com.apploi) application 4.19 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Gulf Power Mobile Bill Pay (aka com.tionetworks.gulf) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Sortir en Alsace (aka com.axessweb.sortirenalsace) application 0.5b for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TH3 professional Al Mohtarif (aka com.th3professional.almohtarif) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Galaxy Online 2 (aka air.com.igg.galaxyAPhone) application 1.2.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The s-peek credit rating report (aka com.rhomobile.speek) application 2.1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The World Cup 2014 Brazil - Xem TV (aka vn.letshare.football.worldcup) application 2.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SlotMachine (aka com.popoinnovation.SlotMachine) application 1.03 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Soap Making (aka com.tapatalk.soapmakingforumcom) application 3.7.13 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DNB Trade (aka lt.dnb.mobiletrade) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Albasit

artes

y

danza

(aka

com.adianteventures.adianteapps.albasit_artes_y_danza)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The MiWay Insurance Ltd (aka com.MiWay.MD) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The AHRAH (aka com.vet2pet.aid219426) application 219426 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The All Navalny (aka com.all.navalny) application 1.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Math for Kids - Subtraction (aka it.tinytap.attsa.deepsub) application 1.2.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Gravity Bounce (aka net.toddm.gb) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Codename

Birdgame

(aka

com.devsecondfictioncom.devsecondfictioncom.birdadhoc)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The ThinkPal (aka com.mythinkpalapp) application 1.6.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Twin Lin (aka com.twinlin.twmo) application 5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Amebra Ameba (aka jp.honeytrap15.amebra) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The mitfahrgelegenheit.at (aka com.carpooling.android.at) application 2.3.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The 5SOS Family Planet (aka uk.co.pixelkicks.fivesos) application 2.3.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Kayak Angler Magazine (aka air.com.yudu.ReaderAIR1360155) application 3.12.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mindless Behavior Fan Base (aka com.mindless.behavior.fan.base) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The LG Telepresence (aka com.rsupport.rtc.lge) application 2.0.12 Build 63 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Western Federal Credit Union (aka com.kerrata.pulse.western) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Suriname Radio (aka com.wordbox.surinameRadio) application 1.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Daily Advertiser Print (aka com.lafayettedailyadv.android.prod) application 6.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Allt om Brollop (aka com.paperton.wl.alltombrollop) application 1.53 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Gratta & Vinci? (aka com.dreamstep.wGrattaevinci) application 0.21.13167.93474 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Shots (aka com.shots.android) application 1.0.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Melodigram (aka com.minusdegree.melodigramandroid) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The wTrootrooTvIzle (aka com.wTrootrooTvIzle) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Ahmed Bukhatir Nasheeds TV (aka com.wAhmedBukhatirApp) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Vendormate Mobile (aka com.vendormate.mobile) application 3.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The www.knote.kr Smart (aka kr.or.knote.android) application 1.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The AMGC (aka com.amec.uae) application 6.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Groupama toujours la (aka com.groupama.toujoursla) application 1.3.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The kamkomesan (aka com.anek.kamkomesan) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Absolute

Lending

Solutions

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The InstaMessage - Instagram Chat (aka com.futurebits.instamessage.free) application 1.6.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Reddit Aww (aka org.biais.redditawww) application 1.2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The WePhone - phone calls vs skype (aka com.wephoneapp) application 1.03.00 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The wEPISDParentPortal (aka com.dreamstep.wEPISDParentPortal) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The iPhone4.TW (aka com.tapatalk.iPhone4TWforums) application 3.3.20 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

PinkFong

TV

(aka

kr.co.smartstudy.pinkfongtv_android_googlemarket)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Juggle! FREE (aka com.jakyl.juggleforfree) application 3.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Easy Video Downloader (aka com.simon.padillar.EasyVideo) application 4.4.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Vouch! (aka com.voucherry.voucherry) application 2.1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The netease movie (aka com.netease.movie) application 4.7.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Maher Zain (aka com.vanagas.app.maher_zain) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Voices.com (aka com.voices.voices) application 1.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

ISMRM-ESMRMB

(aka

com.coreapps.android.followme.ismrm_esmrmb14)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Dive The World (aka com.paperton.wl.divetheworld) application 1.53 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Santander Personal Banking (aka com.sovereign.santander) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The LocalSense (aka com.LocalSense) application 1.2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Four

Seasons

Beverly

Hills

(aka

com.intelitycorp.FourSeasons.android.ice)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The KFAI Community Radio (aka com.skyblue.pra.kfai) application 2.0.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Deltin Suites (aka com.DeltinSuites) application 3.4.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DTE Energy (aka com.dteenergy.mydte) application 3.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The LINE PLAY (aka jp.naver.lineplay.android) application 2.3.1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Wine Making (aka com.gcspublishing.winemakingtalk) application 3.7.15 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The NextGenUpdate (aka com.tapatalk.nextgenupdatecomforums) application 3.1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


iAd Content Display in Apple iOS before 4.2 allows man-in-the-middle attackers to make calls via a crafted URL in an ad.


Photos in Apple iOS before 4.2 enables support for HTTP Basic Authentication over an unencrypted connection which allows man-in-the-middle attackers to read MobileMe account passwords by spoofing a MobileMe Gallery server during a \Send to MobileMe\ action.


Midori before 0.2.5 when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used does not verify X.509 certificates which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate a related issue to CVE-2010-3312.


Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11 Thunderbird before 3.0.9 and 3.1.x before 3.1.5 and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject's Common Name field of an X.509 certificate which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


OpenConnect before 2.25 does not properly validate X.509 certificates which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.


Epiphany 2.28 and 2.29 when WebKit and LibSoup are used unconditionally displays a closed-lock icon for any URL beginning with the https: substring without any warning to the user which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificate.


The bookmarklet pop-up in the Bookmarks component in IBM Lotus Connections 2.5.x before 2.5.0.2 does not properly follow the \force SSL\ setting which might make it easier for remote attackers to obtain the cleartext of network communication by sniffing the network or spoof arbitrary servers via a man-in-the-middle attack.


istream.c in w3m 0.5.2 and possibly other versions when ssl_verify_server is enabled does not properly handle a '\\0' character in a domain name in the (1) subject's Common Name or (2) Subject Alternative Name field of an X.509 certificate which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority a related issue to CVE-2009-2408.


Apache Traffic Server before 2.0.1 and 2.1.x before 2.1.2-unstable does not properly choose DNS source ports and transaction IDs and does not properly use DNS query fields to validate responses which makes it easier for man-in-the-middle attackers to poison the internal DNS cache via a crafted response.


The default installation of Sourcefire 3D Sensor 1000 2000 and 9900; and Defense Center 1000; uses the same static private SSL keys for multiple devices and installations which allows remote attackers to decrypt SSL traffic via a man-in-the-middle (MITM) attack.


Tor before 0.2.1.22 and 0.2.2.x before 0.2.2.7-alpha uses deprecated identity keys for certain directory authorities which makes it easier for man-in-the-middle attackers to compromise the anonymity of traffic sources and destinations.


aMSN (aka Alvaro's Messenger) 0.98.3 and earlier when SSL is used does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.


The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier Windows XP SP3 and earlier Windows Server 2003 SP2 and earlier Windows Server 2008 SP2 and earlier Windows Server 2008 R2 Exchange Server 2003 SP3 and earlier Exchange Server 2007 SP2 and earlier and Exchange Server 2010 does not verify that transaction IDs of responses match transaction IDs of queries which makes it easier for man-in-the-middle attackers to spoof DNS responses a different vulnerability than CVE-2010-0024 and CVE-2010-0025.


WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows and before 4.1 on Mac OS X 10.4 sends NTLM credentials in cleartext in unspecified circumstances which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.


libESMTP probably 1.0.4 and earlier does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority a related issue to CVE-2009-2408.


The DNS implementation in smtpsvc.dll before 6.0.2600.5949 in Microsoft Windows 2000 SP4 and earlier Windows XP SP3 and earlier Windows Server 2003 SP2 and earlier Windows Server 2008 SP2 and earlier Windows Server 2008 R2 Exchange Server 2003 SP3 and earlier Exchange Server 2007 SP2 and earlier and Exchange Server 2010 uses predictable transaction IDs that are formed by incrementing a previous ID by 1 which makes it easier for man-in-the-middle attackers to spoof DNS responses a different vulnerability than CVE-2010-0024 and CVE-2010-0025.


libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates which allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name as demonstrated by use of a www.example.con certificate to spoof www.example.com.


Irssi before 0.8.15 when SSL is used does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate.


QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


offlineimap before 6.3.2 does not check for SSL server certificate validation when \ssl = yes\ option is specified which can allow man-in-the-middle attacks.


The PayPal app before 3.0.1 for iOS does not verify that the server hostname matches the domain name of the subject of an X.509 certificate which allows man-in-the-middle attackers to spoof a PayPal web server via an arbitrary certificate.


libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.


Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.


A flaw was found in all versions of kubeclient up to (but not including) v4.9.3 the Ruby client for Kubernetes REST API in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).


The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore in such a case only an OpenSSL 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. If both endpoints are OpenSSL 3.0 then the attacker could modify data being sent in both directions. In this case both clients and servers could be affected regardless of the application protocol. Note that in the absence of an attacker this bug means that an OpenSSL 3.0 endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete the handshake when using this ciphersuite. The confidentiality of data is not impacted by this issue i.e. an attacker cannot decrypt data that has been encrypted using this ciphersuite - they can only modify it. In order for this attack to work both endpoints must legitimately negotiate the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in OpenSSL 3.0 and is not available within the default provider or the default ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the following must have occurred: 1) OpenSSL must have been compiled with the (non-default) compile time option enable-weak-ssl-ciphers 2) OpenSSL must have had the legacy provider explicitly loaded (either through application code or via configuration) 3) The ciphersuite must have been explicitly added to the ciphersuite list 4) The libssl security level must have been set to 0 (default is 1) 5) A version of SSL/TLS below TLSv1.3 must have been negotiated 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any others that both endpoints have in common Fixed in OpenSSL 3.0.3 (Affected 3.0.0 3.0.1 3.0.2).


WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server after certain GnuTLS options are changed which allows man-in-the-middle attackers to spoof a TLS chat server via an arbitrary certificate. NOTE: this only affects situations where weechat.network.gnutls_ca_system or weechat.network.gnutls_ca_user is changed without a WeeChat restart.


`@chainsafe/libp2p-noise` contains TypeScript implementation of noise protocol an encryption protocol used in libp2p. `@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 does not correctly validate signatures during the handshake process. This may allow a man-in-the-middle to pose as other peers and get those peers banned. Users should upgrade to version 4.1.2 or 5.0.3 to receive a patch. There are currently no known workarounds.


A vulnerability has been discovered in Moxa MGate which allows an attacker to perform a man-in-the-middle (MITM) attack on the device. This affects MGate MB3170 Series Firmware Version 4.2 or lower. and MGate MB3270 Series Firmware Version 4.2 or lower. and MGate MB3280 Series Firmware Version 4.1 or lower. and MGate MB3480 Series Firmware Version 3.2 or lower.


Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier i-FILTER Ver.9.50R10 and earlier i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier and D-SPA (Ver.3 / Ver.4) using i-FILTER allows a remote unauthenticated attacker to conduct a man-in-the-middle attack and eavesdrop on an encrypted communication.


A vulnerability in the key-based SSH authentication mechanism of Cisco Umbrella Virtual Appliance (VA) could allow an unauthenticated remote attacker to impersonate a VA. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability by performing a man-in-the-middle attack on an SSH connection to the Umbrella VA. A successful exploit could allow the attacker to learn the administrator credentials change configurations or reload the VA. Note: SSH is not enabled by default on the Umbrella VA.


A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementation of Galois/Counter Mode (GCM) ciphers. An attacker in a man-in-the-middle position could exploit this vulnerability by intercepting a sufficient number of encrypted messages across an affected IPsec IKEv2 VPN tunnel and then using cryptanalytic techniques to break the encryption. A successful exploit could allow the attacker to decrypt read modify and re-encrypt data that is transmitted across an affected IPsec IKEv2 VPN tunnel.


Apple Safari does not require a cached certificate before displaying a lock icon for an https web site which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server.