The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.


Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack a different vulnerability than CVE-2007-5195.


The (1) Net::ftptls (2) Net::telnets (3) Net::imap (4) Net::pop and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site different components than CVE-2007-5162.


Unspecified vulnerability in the SSL implementation in Groupwise client system in the novell-groupwise-client package in SUSE Linux Enterprise Desktop 10 allows remote attackers to obtain credentials via a man-in-the-middle attack a different vulnerability than CVE-2007-5196.


The Web Proxy Auto-Discovery (WPAD) feature in Microsoft Internet Explorer 6 and 7 when a primary DNS suffix with three or more components is configured resolves an unqualified wpad hostname in a second-level domain outside this configured DNS domain which allows remote WPAD servers to conduct man-in-the-middle (MITM) attacks.


telepathy-idle before 0.1.15 does not verify (1) that the issuer is a trusted CA (2) that the server hostname matches a domain name in the subject's Common Name (CN) or (3) the expiration date of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Meridian Prolog Manager 2007 and 7.5 and earlier sends all usernames and passwords to the client in a (1) cleartext or (2) weakly encrypted format to support client-side login authentication which makes it easier for remote attackers to obtain database access by capturing credentials via a man-in-the-middle attack.


Novell GroupWise 7 before SP2 20070524 and GroupWise 6 before 6.5 post-SP6 20070522 allows remote attackers to obtain credentials via a man-in-the-middle attack.


The Terminal Server in Microsoft Windows 2003 Server when using TLS allows remote attackers to bypass SSL and self-signed certificate requirements downgrade the server security and possibly conduct man-in-the-middle attacks via unspecified vectors as demonstrated using the Remote Desktop Protocol (RDP) 6.0 client. NOTE: a third party claims that the vendor may have fixed this in approximately 2006.


The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications.


Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript a www.google.com search IFRAME and a META HTTP-EQUIV=\refresh\ that targets a www.google.com search for a local .exe file which is displayed in the \results stored on your computer\ portion of the search results and when clicked invokes Google Desktop to execute this file.


dbclient in Dropbear SSH client before 0.49 does not sufficiently warn the user when it detects a hostkey mismatch which might allow remote attackers to conduct man-in-the-middle attacks.


The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP including (1) Thunderbird 1.x before 1.5.0.12 and 2.x before 2.0.0.4 (2) Evolution (3) mutt (4) fetchmail before 6.3.8 (5) SeaMonkey 1.0.x before 1.0.9 and 1.1.x before 1.1.2 (6) Balsa 2.3.16 and earlier (7) Mailfilter before 0.8.2 and possibly other products.


BEA WebLogic Server 8.1 through 8.1 SP5 9.0 9.1 and 9.2 Gold when WS-Security is used does not properly validate certificates which allows remote attackers to conduct a man-in-the-middle (MITM) attack.


The HTTP clients in the (1) httplib (2) urllib (3) urllib2 and (4) xmlrpclib libraries in CPython (aka Python) 2.x before 2.7.9 and 3.x before 3.4.3 when accessing an HTTPS URL do not (a) check the certificate against a trust store or verify that the server hostname matches a domain name in the subject's (b) Common Name or (c) subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The automatic signature update functionality in the (1) Phone Home feature in F5 BIG-IP LTM AAM AFM Analytics APM GTM and Link Controller 11.5.0 through 11.6.0 ASM 10.0.0 through 11.6.0 and PEM 11.3.0 through 11.6.0 and the (2) Call Home feature in ASM 10.0.0 through 11.6.0 and PEM 11.3.0 through 11.6.0 does not properly validate server SSL certificates which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.


vdsm and vdsclient does not validate certficate hostname from another vdsm which could facilitate a man-in-the-middle attack


The SSL profiles component in F5 BIG-IP LTM APM and ASM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1 AAM 11.4.0 through 11.5.1 AFM 11.3.0 through 11.5.1 Analytics 11.0.0 through 11.5.1 Edge Gateway WebAccelerator and WOM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0 PEM 11.3.0 through 11.6.0 and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.4.1 and BIG-IQ Cloud and Security 4.0.0 through 4.4.0 and Device 4.2.0 through 4.4.0 when using TLS 1.x before TLS 1.2 does not properly check CBC padding bytes when terminating connections which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack a variant of CVE-2014-3566 (aka POODLE). NOTE: the scope of this identifier is limited to the F5 implementation only. Other vulnerable implementations should receive their own CVE ID since this is not a vulnerability within the design of TLS 1.x itself.


The Hijab Modern (aka com.Aisyaidea.HijabModern) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The darwinssl_connect_step1 function in lib/vtls/curl_darwinssl.c in libcurl 7.31.0 through 7.39.0 when using the DarwinSSL (aka SecureTransport) back-end for TLS does not check if a cached TLS session validated the certificate when reusing the session which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


Pexip Infinity before 8 uses the same SSH host keys across different customers' installations which allows man-in-the-middle attackers to spoof Management and Conferencing Nodes by leveraging these keys.


GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.


IBM Security AppScan Standard 8.x and 9.x before 9.0.1.1 FP1 does not properly verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


VMware vCenter Server Appliance (vCSA) 5.5 before Update 2 5.1 before Update 3 and 5.0 before Update 3c does not properly validate certificates when connecting to a CIM Server on an ESXi host which allows man-in-the-middle attackers to spoof CIM servers via a crafted certificate.


wolfSSL CyaSSL before 2.9.4 does not properly validate X.509 certificates with unknown critical extensions which allows man-in-the-middle attackers to spoof servers via crafted X.509 certificate.


The Birebin.com application for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The East Japan Railway Company JR East Japan application before 1.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to obtain sensitive information via a crafted certificate.


Cyberduck before 4.4.4 on Windows does not properly validate X.509 certificate chains which allows man-in-the-middle attackers to spoof FTP-SSL servers via a certificate issued by an arbitrary root Certification Authority.


curl and libcurl 7.27.0 through 7.35.0 when running on Windows and using the SChannel/Winssl TLS backend does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.


The Misli.com application for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The OpenConnectionTask::handleStateHelper function in Imap/Tasks/OpenConnectionTask.cpp in Trojita before 0.4.1 allows man-in-the-middle attackers to trigger use of cleartext for saving a message into a (1) sent or (2) draft folder via a PREAUTH response that prevents later use of the STARTTLS command.


plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.


cn.wps.moffice.common.beans.print.CloudPrintWebView

in

Kingsoft

Office

as

used

in

Huawei

devices

before

falls

back

to

HTTP

when

the

HTTPS

connection

to

the

registry

fails

which

allows

man-in-the-middle

attackers

to

conduct

downgrade

attacks

and

execute

arbitrary

Java

code

by

leveraging

a

network

position

between

the

client

and

the

registry

to

block

HTTPS

traffic.


WinSCP before 5.5.3 when FTP with TLS is used does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.


The Bilyoner application before 2.3.1 for Android and before 4.6.2 for iOS does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The CyberAgent Ameba application 3.x and 4.x before 4.5.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The (1) serf_ssl_cert_issuer (2) serf_ssl_cert_subject and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


org.apache.http.conn.ssl.AbstractVerifier

in

Apache

HttpComponents

HttpClient

before

and

HttpAsyncClient

before

does

not

properly

verify

that

the

server

hostname

matches

a

domain

name

in

the

subject's

Common

Name

(CN)

or

subjectAltName

field

of

the

certificate

which

allows

man-in-the-middle

attackers

to

spoof

SSL

servers

via

a

\CN=\

string

in

a

field

in

the

distinguished

name

(DN)

of

a

certificate

as

demonstrated

by

the

\foo

CN=www.apache.org\

string

in

the

O

field.


The Internet Service Monitor (ISM) agent in IBM Tivoli Composite Application Manager (ITCAM) for Transactions 7.1 and 7.2 before 7.2.0.3 IF28 7.3 before 7.3.0.1 IF30 and 7.4 before 7.4.0.0 IF18 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain credential information via a crafted certificate.


The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


Cisco TelePresence System (CTS) 6.0(.5)(5) and earlier falls back to HTTP when certain HTTPS sessions cannot be established which allows man-in-the-middle attackers to obtain sensitive directory information by leveraging a network position between CTS and Cisco Unified Communications Manager (UCM) to block HTTPS traffic aka Bug ID CSCuj26326.


The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions related to a \protocol downgrade\ issue.


The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.


kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.


The Public Key Pinning (PKP) implementation in Mozilla Firefox before 33.0 does not properly consider the connection-coalescing behavior of SPDY and HTTP/2 in the case of a shared IP address which allows man-in-the-middle attackers to bypass an intended pinning configuration and spoof a web site by providing a valid certificate from an arbitrary recognized Certification Authority.


Secure Transport in Apple iOS before 7.1.1 Apple OS X 10.8.x and 10.9.x through 10.9.2 and Apple TV before 6.1.1 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a \triple handshake attack.\


VMware vSphere Client 5.0 before Update 3 and 5.1 before Update 2 does not properly validate X.509 certificates which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.


The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.


The Denny's application before 2.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SSLVerifySignedServerKeyExchange function in libsecurity_ssl/lib/sslKeyExchange.c in the Secure Transport feature in the Data Security component in Apple iOS 6.x before 6.1.6 and 7.x before 7.0.6 Apple TV 6.x before 6.0.2 and Apple OS X 10.9.x before 10.9.2 does not check the signature in a TLS Server Key Exchange message which allows man-in-the-middle attackers to spoof SSL servers by (1) using an arbitrary private key for the signing step or (2) omitting the signing step.


SChannel in Microsoft Internet Explorer 6 through 11 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a \triple handshake attack \ aka \TLS Server Certificate Renegotiation Vulnerability.\


curl and libcurl 7.27.0 through 7.35.0 when using the SecureTransport/Darwinssl backend as used in in Apple OS X 10.9.x before 10.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.


Citrix ShareFile Mobile and ShareFile Mobile for Tablets before 2.4.4 for Android do not verify X.509 certificates from SSL servers which allow man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream.


The Demaecan application 2.1.0 and earlier for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.


The ServerTrustManager component in the Ignite Realtime Smack XMPP API before 4.0.0-rc1 does not verify basicConstraints and nameConstraints in X.509 certificate chains from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate chain.


OpenStack Heat Templates (heat-templates) as used in Red Hat Enterprise Linux OpenStack Platform 4.0 uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories which allows man-in-the-middle attackers to prevent updates via unspecified vectors.


APT before 1.0.4 does not properly validate source packages which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.


cURL and libcurl 7.1 before 7.36.0 when using the OpenSSL axtls qsossl or gskit libraries for TLS recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


The Expressway component in Cisco TelePresence Video Communication Server (VCS) uses the same default X.509 certificate across different customers' installations which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship aka Bug ID CSCue07471.


OpenStack Heat Templates (heat-templates) as used in Red Hat Enterprise Linux OpenStack Platform 4.0 sets sslverify to false for certain Yum repositories which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.


EMC RSA BSAFE Micro Edition Suite (MES) 3.2.x before 3.2.6 and 4.0.x before 4.0.5 does not properly validate X.509 certificate chains which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate chain.


In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.


The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites which makes it easier for man-in-the-middle attackers to obtain sensitive information or interfere with communications by modifying the client-server data stream.


OpenSSL before 0.9.8za 1.0.0 before 1.0.0m and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications and consequently hijack sessions or obtain sensitive information via a crafted TLS handshake aka the \CCS Injection\ vulnerability.


ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.


lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


The Remote Desktop Protocol (RDP) implementation in Microsoft Windows 7 SP1 Windows 8 Windows 8.1 and Windows Server 2012 Gold and R2 does not properly encrypt sessions which makes it easier for man-in-the-middle attackers to obtain sensitive information by sniffing the network or modify session content by sending crafted RDP packets aka \RDP MAC Vulnerability.\


The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.


The AutoUpdate process in IBM Security QRadar SIEM 7.2 MR1 and earlier does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


OpenStack Heat Templates (heat-templates) as used in Red Hat Enterprise Linux OpenStack Platform 4.0 sets gpgcheck to 0 for certain templates which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.


The Herpin Time Radio (aka com.herpin.time.radio) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The migme (aka com.projectgoth) application 4.03.002 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CT iHub (aka com.concursive.ctihub) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Crossmo Calendar (aka com.crossmo.calendar) application 1.7.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Diabetic Diet Guide (aka com.wDiabeticDietGuide) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CPWORLD Close Protection World (aka com.tapatalk.closeprotectionworldcom) application 3.4.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The PartyTrack library for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Indian Cement Review (aka com.magzter.indiancementreview) application 3.01 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


IBM PowerVC 1.2.0 before FixPack3 does not properly use the known_hosts file which allows man-in-the-middle attackers to spoof SSH servers via an arbitrary server key.


EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.6 and RSA BSAFE SSL-J before 6.1.4 do not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation which allows man-in-the-middle attackers to obtain sensitive information or modify TLS session data via a \triple handshake attack.\


The Conrad Hotel (aka com.wConradHotel) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Harivijay (aka com.upasanhar.marathi.harivijay) application 4.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MyMetro (aka com.myrippleapps.mymetro) application 2.4.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Bond Trading (aka com.appmakr.app613309) application 197705 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Nano Digest (aka com.magzter.nanodigest) application 3.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Clean Internet Browser (aka com.cleantab.browsesecure) application 1.36 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The BattleFriends at Sea GOLD (aka com.tequilamobile.warshipslivegold) application 1.1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


VMware vSphere Data Protection (VDP) 5.1 5.5 before 5.5.9 and 5.8 before 5.8.1 and the proxy client in EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x do not properly verify X.509 certificates from vCenter Server SSL servers which allows man-in-the-middle attackers to spoof servers and bypass intended backup and restore access restrictions via a crafted certificate.


The Assets subsystem in Apple iOS before 8 and Apple TV before 7 allows man-in-the-middle attackers to spoof a device's update status via a crafted Last-Modified HTTP response header.


The

Parque

Imperial

(aka

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Kakao Bingo Garden (aka com.mocoga.bingogarden) application 1.0.14 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The uControl Smart Home Automation (aka de.ucontrol) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


iCloud Data Access in Apple iOS before 8.1 does not verify X.509 certificates from TLS servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Touriosity Travelmag (aka com.magzter.touriositytravelmag) application 3.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Brisbane & Queensland Alert (aka com.queensland.alert) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Joint Radio Blues (aka com.nobexinc.wls_69685189.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


resolv.c in the DNS resolver in uIP and dns.c in the DNS resolver in lwIP 1.4.1 and earlier does not use random values for ID fields and source ports of DNS query packets which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.


The AVON Buy & Sell (aka com.AVONBeautyntheRep) application 0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Runtastic Timer (aka com.runtastic.android.timer) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The longjiang (aka com.longjiang.kr) application 2.0.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The PocketPC.ch (aka com.tapatalk.pocketpcch) application 3.9.51 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The PopU 2: Get Likes on Instagram (aka com.popuapp.popu) application 1.7.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The iVysilani ceske televize (aka cz.motion.ivysilani) application 1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Buy 99 Cents Only Products (aka com.ww99CentsOnlyStores) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mega Jump (aka com.getsetgames.megajump) application @7F080002 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DeskRoll Remote Desktop (aka com.deskroll.client1) application 0.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The IM+ (aka de.shapeservices.impluslite) application 6.6.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SkyDrive Assistant (aka com.dhh.sky) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Chat Flirt & Dating Heart JAUMO (aka com.jaumo) application 2.7.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Fiksu library for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Solitaire Arena (aka com.mavenhut.solitaire) application 1.0.15 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Africa Memory (aka air.com.klon4enabor4e.AfricaMemory) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Anger of Stick 3 (aka com.miniclip.angerofstick3) application 1.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Sonic CD Lite (aka com.soa.sega.soniccdlite) application 1.0.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The BIATNET (aka com.biatnet.mobile) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Allies in War (aka com.gamelion.aiw) application 1.3.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TV Guide (aka net.micene.minigroup.palimpsests.lite) application 5.4.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Adcolony library for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ChatBox - Chat Rooms (aka com.droidchatroom.messengerapp) application 2.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Runtastic Pedometer (aka com.runtastic.android.pedometer.lite) application 1.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The healthylifestyle (aka com.alek.healthylifestyle) application 1.2.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Fairy

Princess

Makeover

Salon

(aka

com.mobgams.dressup.fairy.princess.makeover)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The ga6748 (aka com.g.ga6748) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Chest Workout (aka net.p4p.chest) application 2.0.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Buy Books (aka com.wBooksForSale) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Traffic Jam Free (aka com.jiuzhangtech.rushhour) application 1.7.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Genertel (aka com.genertel) application 2.6.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Vevo - Watch HD Music Videos (aka com.vevo) application 2.0.27 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Where's My Water? Free (aka com.disney.WMWLite) application 1.9.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Kid Mode: Free Games + Lock (aka com.zoodles.kidmode) application 4.9.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Hidden

Object

Mystery

(aka

air.com.differencegames.hodetectivemysteryfree)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The eponyms (aka com.anddeveloper.eponyms) application 3.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ZOOM Cloud Meetings (aka us.zoom.videomeetings) application @7F060008 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Scoutmob local deals & events (aka com.scoutmob.ile) application 3.0.18 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The OkCupid Dating (com.okcupid.okcupid) application 3.4.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Westmoreland Water FCU (aka air.com.creditunionhomebanking.mb115) application 1.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Soccer Blitz (aka soccer.blitz) application 1.06 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Appstros - FREE Gift Cards! (aka com.appstros.main) application 1.1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


FileMaker Pro before 13 and Pro Advanced before 13 does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-2319.


The Homoo Ijiri (aka jp.co.applica) application 3.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The wTradersActivity (aka com.wTradersActivity) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Cloud Browser (aka com.granitamalta.cloudbrowser) application 2.2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The BIKE RACING 2014 (aka com.timuzsolutions.bikeracing2014) application 1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The 2G Live Tv (aka com.ww2GLiveTv) application 0.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DCU Mobile Banking (aka com.Vertifi.Mobile.P211391825) application 2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Reign of Dragons: Build-Battle (aka net.gree.android.pf.greeapp57501) application 2.4.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Smart Browser (aka smartbrowser.geniuscloud) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The russkoe TB HD (aka com.videotelecom.russkoeHD) application 3.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Kaspersky Internet Security (aka com.kms.free) application 11.4.4.232 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Little Dragons (aka com.playcomo.dragongame) application 1.0.256 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Ingress Intel Helper (aka com.bb.ingressintel) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mzone Login (aka com.mr384.MzoneLogin) application 1.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Skout: Chats. Friends. Fun. (aka com.skout.android) application 4.3.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Girls Games - Shoes Maker (aka com.g6677.android.shoemaker) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate.


The Slideshow 365 (aka com.Slideshow) application 3.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Sears (aka com.sears.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Government Best Jobs (aka com.wGovernmentBestJobs) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Follow Mania for Instagram (aka com.followmania) application 1.2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The GlobalTalk- free phone calls (aka com.seawolftech.globaltalk) application 2.1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The 9GAG - Funny pics and videos (aka com.ninegag.android.app) application 2.4.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Solitaire Deluxe (aka com.gosub60.solfree2) application 2.8.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The NOW (aka com.smtown.smtownnow.androidapp) application 0.9.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Tapatalk (aka com.quoord.tapatalkpro.activity) application 4.8.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The hasb_e_haal (aka com.anawaz.hasb_e_haal) application 1.0.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Fly Fishing & Fly Tying (aka air.com.yudu.ReaderAIR3209899) application 3.21.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The russiananime (aka com.rareartifact.russiananime68A5CCFE) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Dating for everyone - Mamba! (aka ru.mamba.client) application 3.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MercadoLibre (aka com.mercadolibre) application 3.8.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Azkend Gold (aka com.the10tons.azkend.gold) application 1.2.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Able Remote (aka com.entertailion.android.remote) application 2.3.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The icon wallpaper dressup-CocoPPa (aka jp.united.app.cocoppa) application 2.8.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Furdiburb (aka com.sheado.lite.pet) application 1.1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Obama for America (aka com.barackobama.ofa) application 1.02 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Princess Shopping (aka air.android.PrincessShopping) application 2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Capital One Spark Pay (aka com.capitalone.sparkpay) application 0.9.81 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Homerun

Battle

(aka

com.com2us.homerunbattle2.normal.freefull.google.global.android.common)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Super Stickman Golf (aka com.noodlecake.ssg) application 2.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Street Racing (aka com.tgb.streetracing.lite5pp) application 4.0.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The cookbible (aka net.bookjam.cookbible) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Gambling Insider Magazine (aka com.triactivemedia.gambling) application @7F0801AA for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CM Backup -Restore Cloud Photo (aka com.ijinshan.kbackup) application 1.1.0.135 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Jewels

Diamonds

(aka

mominis.Generic_Android.Jewels_and_Diamonds)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Selfie Camera -Facial Beauty- (aka com.cfinc.cunpic) application 1.2.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Vodafone Mobile@Work (aka com.mobileiron.vodafone.MIClient) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TV Bengali Open Directory (aka com.TVBengali) application 1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The GrooveMusic (aka com.mobincube.android.sc_2HKFF) application 2.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DataGard VPN + AV (aka ocshield.com) application @7F050013 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Numbers

Addition!

Math

games

(aka

air.com.tribalnova.ilearnwith.ipad.App2En)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Exsoul Web Browser (aka com.exsoul) application 3.3.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The RegisteredAssistant (aka Icr.RegisteredAssistant) application 0.2.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Garfield's Defense (aka com.webprancer.google.garfieldDefense) application 1.5.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Donut Maker (aka com.sunstorm.android.donut) application 1.27 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Eversnap Private Photo Album (aka com.weddingsnap.android) application 1.0.23 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Brothers In Arms 2 Free+ (aka com.gameloft.android.ANMP.GloftB2HM) application 1.2.0b for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The greenbill (aka com.show.greenbill_G) application 2.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Show do Milhao 2014 (aka br.com.lgrmobile.sdm) application 1.4.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Farm Frenzy Gold (aka com.herocraft.game.farmfrenzy.gold) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The State Bank Anywhere (aka com.sbi.SBIFreedomPlus) application 2.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Appsflyer library for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Runtastic Running & Fitness (aka com.runtastic.android) application 5.1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ding* ezetop. Top-up Any Phone (aka com.ezetop.world) application 1.3.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Bike Race Free - Top Free Game (aka com.topfreegames.bikeracefreeworld) application 4.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Brightest

LED

Flashlight

(aka

com.intellectualflame.ledflashlight.washer)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The PHONE for Google Voice & GTalk (aka com.moplus.gvphone) application 1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Bouncy

Bill

Halloween

(aka

mominis.Generic_Android.Bouncy_Bill_Halloween)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The

Kakao

(aka

com.com2us.tinypang.kakao.freefull2.google.global.android.common)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The INCOgnito Private Browser (aka com.SL.InCoBrowser) application 1.4.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Pet Salon (aka com.libiitech.petsalon) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The mpang.gp (aka air.com.cjenm.mpang.gp) application 4.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The 3Kundenzone (aka com.hutchison3g.at.android.selfcare) application 2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Phonegram - Instagram Download (aka com.pinssible.padgram) application 1.9.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Microsoft Tech Companion (aka com.technet) application 1.0.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Free Dating Heart COL (aka com.choiceoflove.dating) application 2.6.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The BAND -Group sharing & planning (aka com.nhn.android.band) application 3.2.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The XFINITY Constant Guard Mobile (aka com.whitesky.mobile.android) application 3.1.140603 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The penguinchefshop (aka com.freegames.penguinchefshop) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Parallel Mafia MMORPG (aka com.perblue.pm.client) application @7F070000 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Selfshot - Front Flash Camera (aka com.americos.selfshot) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Club Personal (aka com.globant.clubpersonal) application 2.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SinoPac (aka com.sionpac.app.SinoPac) application 2.4.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The XDA-Developers (aka com.quoord.tapatalkxda.activity) application 3.9.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The BundesArztsuche (aka de.kbv.bas) application 1.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mail.Ru Dating (aka ru.mail.love) application 3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

America's

Economy

for

Phone

(aka

air.gov.census.mobile.phone.americaseconomy)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Gmarket (aka com.ebay.kr.gmarket) application 5.1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The PlayMemories Online (aka jp.co.sony.tablet.PersonalSpace) application 4.2.0.05070 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ASTRO File Manager with Cloud (aka com.metago.astro) application ASTRO-4.4.592 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The baby days (aka jp.co.cyberagent.babydays) application 1.5.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The UA Cinemas - Mobile ticketing (aka com.mtel.uacinemaapps) application 2.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CA DMV (aka gov.ca.dmv) application 2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Parallel Kingdom MMO (aka com.silvermoon.client) application @7F070019 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TICKET APP - Concerts & Sports (aka com.xcr.android.ticketapp) application 3.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Baby Get Up - Kids Care (aka air.brown.jordansa.getup) application 1.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SAS: Zombie Assault 3 (aka com.ninjakiwi.sas3zombieassault) application 2.56 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Text Me! Free Texting & Call (aka com.textmeinc.textme) application 2.5.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Innings:

Pro

Baseball

(aka

com.com2us.nipb2013.normal.freefull.google.global.android.common)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Skin Conditions and Diseases (aka com.appsgeyser.wSkinConditions) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Truecaller - Caller ID & Block (aka com.truecaller) application 4.32 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Cloud Manager (aka com.ileaf.cloud_manager) application 1.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The memetan (aka memetan.android.com.activity) application 1.1.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Ninja Chicken (aka mominis.Generic_Android.Ninja_Chicken) application 1.7.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The White & Yellow Pages (aka com.avantar.wny) application 5.1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Coke Studio 7 (aka com.cokeshare.pakistan) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Kids

Preschool

Learning

Games

(aka

air.com.tribalnova.ilearnwith.ipad.App3En)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The MegaBank (aka com.megabank.mobilebank) application 2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The smart.nhibzbanking (aka nh.smart.nhibzbanking) application 2.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Garfield's Diner (aka com.webprancer.google.GarfieldsDiner) application 1.4.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Web Browser & Explorer (aka com.explore.web.browser) application 2.0.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Government Bookstore (aka hksarg.isd.sop.govbookstore) application 1.01 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The RE-VOLT 2 : Best RC 3D Racing (aka com.wego.revolt2_global) application 1.2.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Ice Age Village (aka com.gameloft.android.ANMP.GloftIAHM) application 2.8.0m for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The froyo (aka com.shinsegae.mobile.froyo) application 5.1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Best Racing/moto Games Ranking (aka com.subapp.android.racing) application 2.2.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Ignite Realtime Smack XMPP API 4.x before 4.0.2 and 3.x and 2.x when a custom SSLContext is used does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


The Hotel Story: Resort Simulation (aka com.happylabs.hotelstory) application 1.7.9B for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Atomic Fusion (aka com.bytesized.fusion) application 1.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Gameloft library for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Runtastic Heart Rate (aka com.runtastic.android.heartrate.lite) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Coles Credit Card App (aka au.com.colesfinancialservices.mobile) application 1.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The eWUS mobile (aka pl.dreryk.ewustest) application 1.4.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Touchnote Postcards (aka com.touchnote.android) application 4.2.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CamScanner -Phone PDF Creator (aka com.intsig.camscanner) application 3.4.0.20140624 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Bouncy

Bill

Monster

Smasher

ed

(aka

mominis.Generic_Android.Bouncy_Bill_Monster_Smasher_Edition)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The

Knights

N

Squires

(aka

com.com2us.imhero.normal.freefull.google.global.android.common)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Social Networking (aka com.wSocialNetworkingSites) application 0.33.13320.99980 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Tiny Tower (aka com.mobage.ww.a560.tinytower_android) application 1.7.0.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Abode (aka abode.webview) application 1.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Hobby Lobby Stores (aka com.hobbylobbystores.android) application 2.1.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Lil Wayne Slots: FREE SLOTS (aka com.lilwayneslots.slots.android) application 1.138 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ecalendar2 (aka cn.etouch.ecalendar2) application 4.5.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Christian Dating Cafe (aka com.christiancafe.mobile.android) application 1.0.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The PicsArt - Photo Studio (aka com.picsart.studio) application 4.5.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Cisco

Class

Locator

Fast

Lane

(aka

com.tabletkings.mycompany.fastlane.cisco)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Best Phone Security (aka com.rvappstudios.phonesecurity) application for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Guess The Movie (aka com.june.guessthemovie) application 2.982 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Armpit Spa & Girl Games (aka com.freegames.spamakeover) application 1.0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Avira Secure Backup (aka com.avira.avirabackup) application 1.2.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Yell Local Search (aka com.yell.launcher2) application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Buy Tickets (aka com.xcr.android.buytickets) application 2.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Kiss Kiss Office (aka com.girlsgames123.kisskissoffice) application 1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The IQ Test (aka com.pophub.androidiqtest.free) application 3.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

autonavi

(aka

com.telenav.doudouyou.android.autonavi)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The iLove - Free Dating & Chat App (aka com.jestadigital.android.ilove) application 1.3.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Magzter -Magazine & Book Store (aka com.dci.magzter) application 3.31 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Uber B2B (aka de.mobileeventguide.uberb2b) application 1.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Mahjong Galaxy Space Lite (aka air.com.permadi.mahjongIris) application 2.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The BabyBus (aka com.sinyee.babybus.concert.ru) application 3.91 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The brokenscreencrank (aka com.biggame.brokenscreencrank) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The TN Members 1st FCU-RDC (aka com.metova.cuae.tmffcu) application 1.0.28 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MoMinis library for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The tx Smart (aka com.wooriwm.txsmart) application 7.05 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Runtastic Road Bike (aka com.runtastic.android.roadbike.lite) application 2.0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The InNote (aka com.intsig.notes) application 1.0.3.20131119 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The WD My Cloud (aka com.wdc.wd2go) application 4.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Big Win Slots - Slot Machines (aka com.gosub60.BigWinSlots) application 1.11.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Facebook Status Via (aka com.StatusViaAdvanced) application 3.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The smart (aka nh.smart) application 3.0.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The iGolf - Golf GPS (aka com.igolf) application 20 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Buy A Gift (aka com.wBuyAGift) application 13529.90084 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Kicksend: Share & Print Photos (aka com.kicksend.android) application 3.3.2.18 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MoWeather (aka com.moji.moweather) application 1.40.05 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Where's My Perry? Free (aka com.disney.WMPLite) application 1.5.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Cut the Rope: Time Travel (aka com.zeptolab.timetravel.free.google) application 1.3.4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Viddy (aka com.viddy.Viddy) application 1.3.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The PSECU Mobile+ (aka com.Vertifi.Mobile.P231381116) application 2.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The SGK Hizmet Dokumu 4a (aka tr.gov.sgk.hizmetDokumu4a) application 1.103 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Hidden

Object

Alice

Free

(aka

air.com.differencegames.hovisionsofalicefree)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Jazzpodium De Tor (aka com.appmakr.app273713) application 206160 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Hello Kitty Cafe (aka com.sd.google.helloKittyCafe) application 1.4.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Guitar Tuner Free - GuitarTuna (aka com.ovelin.guitartuna) application 2.4.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Michael Baker FCU (aka air.com.creditunionhomebanking.mb155) application 1.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Edline Mobile (aka com.wEdlineFree) application 0.63.13369.34294 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The 7-ELEVEN (aka ecowork.seven) application 2.08.000 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Twitter No Background (aka com.wTwitternobackground) application 0.85.13509.97828 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Eu Sei (aka com.guilardi.eusei) application eusei_android_5.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Whisper (aka sh.whisper) application 4.0.6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ADP AGENCY Immobiliare (aka com.wAdpagencyAndroid) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The FastCustomer -- Fast Customer (aka www.fastcustomer.com) application 3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Bilgi Yarisi (aka net.mobilecraft.bilgiyarisi) application 1.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Word Search (aka com.virtuesoft.wordsearch) application 2.3.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The CM Browser - Fast & Secure (aka com.ksmobile.cb) application 5.0.50 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Animal Kaiser Zangetsu (aka com.wAnimalKaiserZangetsu) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Spider Solitaire (aka com.mobilityware.spider) application 3.0.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Brain lab - brain age games IQ (aka com.sixdead.brainlab) application 2.37 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Most Popular Ringtones (aka com.bbs.mostpopularringtones) application 32 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Minha Oi (aka br.com.mobicare.minhaoi) application 1.15.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

SafeNetMobile

Pass

(aka

securecomputing.devices.android.controller)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The

Acces

Compte

(aka

com.fullsix.android.labanquepostale.accountaccess)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Secret Circle - talk freely (aka com.easyxapp.secret) application 2.2.00.26 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Angry Gran Toss (aka com.aceviral.angrygrantoss) application 1.1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The My Railway (aka com.gameinsight.myrailway) application 1.1.33 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The KASKUS (aka com.kaskus.android) application 2.13.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Piano Teacher (aka com.rubycell.pianisthd) application 20140730 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The FREE Pageplus Activation (aka com.wFREEPageplusActivations) application 0.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Office Zombie (aka com.fluik.OfficeZombieGoogleFree) application 1.3.13 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ShopYourWay (aka com.sears.shopyourway) application 1.9 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The ce4arab market (aka com.dreamstep.wce4arabmarket) application 0.12.13093.40460 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Web Browser & Explorer (aka internetexplorer.browser.webexplorer) application 4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Guess The Actor (aka com.gamelikeinc.actors) application 1.1 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The World of Tanks Assistant (aka ru.worldoftanks.mobile) application 1.7.5 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The emartmall (aka kr.co.emart.emartmall) application 1.3.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Counting

Addition

Kids

Games

(aka

air.com.tribalnova.ilearnwith.ipad.PokoAddEn)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The NQ Mobile Security & Antivirus (aka com.nqmobile.antivirus20) application 7.2.16.00 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The GUNSHIP BATTLE : Helicopter 3D (aka com.theonegames.gunshipbattle) application 1.1.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

actionpuzzlefamily

for

Kakao

(aka

com.com2us.actionpuzzlefamily.kakao.freefull.google.global.android.common)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The ADT Taxis (aka com.icabbi.adttaxisApp) application 6 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Swish payments (aka se.bankgirot.swish) application 2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Abduction Stacker Free (aka air.com.chewygames.abductionstacker2) application 1.0.7 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Bouncy

Bill

World-Cup

(aka

mominis.Generic_Android.Bouncy_Bill_World_Cup)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The CJmall (aka com.cjoshppingphone) application 4.1.8 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Stop & Shop SCAN IT! Mobile (aka com.modivmedia.scanitss) application 7.21.00 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Line Runner (Free) (aka com.djinnworks.linerunnerfree) application 4 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The MLB Preplay (aka com.preplay.android.mlb) application 5.4.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The uTorrent Remote (aka com.utorrent.web) application 1.0.20110929 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Instachat -Instagram Messenger (aka com.instachat.android) application 1.6.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Love Collage - Photo Editor (aka com.etoolkit.lovecollage) application 1.3 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The Web Browser for Android (aka explore.web.browser) application 1.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The

Alphabet

Spelling

Kids

Games

(aka

air.com.tribalnova.ilearnwith.ipad.App1En)

application

for

Android

does

not

verify

certificates

from

SSL

servers

which

allows

man-in-the-middle

attackers

to

spoof

servers

and

obtain

sensitive

information

via

a

crafted

certificate.


The Maleficent Free Fall (aka com.disney.maleficent_goo) application 1.2.0 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


The smart.card (aka nh.smart.card) application 3.2 for Android does not verify X.509 certificates from SSL servers which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.