Skip to main content

Sas CVE-2014-5670

MEDIUM
Cryptographic Issues (CWE-310)
2014-09-09 cret@cert.org
Information Disclosure Google Sas
5.4
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:A/AC:M/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Adjacent
Attack Complexity
M
Confidentiality
P
Integrity
P
Availability
P

Lifecycle Timeline

1
CVE Published
Sep 09, 2014 - 01:55 cve.org
MEDIUM 5.4

DescriptionCVE.org

The SAS: Zombie Assault 3 (aka com.ninjakiwi.sas3zombieassault) application 2.56 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

AnalysisAI

The SAS: Zombie Assault 3 (aka com.ninjakiwi.sas3zombieassault) application 2.56 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. The SAS: Zombie Assault 3 (aka com.ninjakiwi.sas3zombieassault) application 2.56 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. Affected products include: Ninjakiwi Sas\.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Sas

View all
CVE-2019-14678 CRITICAL POC
10.0 Nov 14

SAS XML Mapper 9.45 has an XML External Entity (XXE) vulnerability that can be leveraged by malicious attackers in multi
CVE-2021-41569 HIGH POC
7.5 Nov 19

SAS/Intrnet 9.4 build 1520 and earlier allows Local File Inclusion. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2020-7667 HIGH POC
7.5 Jun 24

In package github.com/sassoftware/go-rpmutils/cpio before version 0.1.0, the CPIO extraction functionality doesn't sanit
CVE-2014-2262 CRITICAL
9.3 Mar 01

Buffer overflow in the client application in Base SAS 9.2 TS2M3, SAS 9.3 TS1M1 and TS1M2, and SAS 9.4 TS1M0 allows user-
CVE-2014-5454 MEDIUM
6.0 Aug 25

Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authentica
CVE-2022-25256 MEDIUM
6.1 Feb 19

SAS Web Report Studio 4.4 allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no a
CVE-2023-4932 MEDIUM
5.4 Dec 12

SAS application is vulnerable to Reflected Cross-Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnerabil
CVE-2023-24724 MEDIUM
5.4 Apr 03

A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Cons
CVE-2021-35475 MEDIUM
5.4 Jun 25

SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. Rated medium severity (CVS
CVE-2020-9350 MEDIUM
5.4 Feb 23

Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly. Rated medium severi

Same weakness CWE-310 – Cryptographic Issues

View all
CVE-2015-0204 MEDIUM POC
4.3
CVE-2015-4000 LOW POC
3.7
CVE-2014-3566 LOW POC
3.4
CVE-2014-8684 CRITICAL POC
9.8
CVE-2012-1803 HIGH POC
8.5
CVE-2013-4787 CRITICAL POC
9.3
CVE-2014-8686 CRITICAL POC
9.8
CVE-2013-0137 CRITICAL
10.0

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2014-5670 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy