Skip to main content

Information Disclosure

70997 CVEs technique

Monthly

Sort: Newest CVSS Score EPSS Score Oldest
CVE-2014-5905 MEDIUM This Month

The Grocery List - Tomatoes (aka com.meucarrinho) application 5.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Grocery List Tomatoes
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5904 MEDIUM This Month

The MiniInTheBox Online Shopping (aka com.miniinthebox.android) application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Miniinthebox Online Shopping
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5903 MEDIUM This Month

The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Mobile Work
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5902 MEDIUM This Month

The UA Cinemas - Mobile ticketing (aka com.mtel.uacinemaapps) application 2.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ua Cinemas Mobile Ticketing
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5901 MEDIUM This Month

The Beauty Bible - App for Girls (aka com.my.beauty.bible) application 5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Beauty Bible App For Girls
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5900 MEDIUM This Month

The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Myhomework Student Planner
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5899 MEDIUM This Month

The Nespresso (aka com.nespresso.activities) application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Nespresso
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5898 MEDIUM This Month

The Heavy Duty Truck Driver Simulator 3D (aka com.oas.heavy.duty.truck.driver.simulator3d) application 1.0.5 for Android does not verify X.509 certificates from SSL servers, which allows. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Heavy Duty Truck Driver Simulator 3D
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5897 MEDIUM This Month

The Parallel Mafia MMORPG (aka com.perblue.pm.client) application @7F070000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Parallel Mafia Mmorpg
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5896 MEDIUM This Month

The GlobalTalk- free phone calls (aka com.seawolftech.globaltalk) application 2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Globaltalk Free Phone Calls
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5895 MEDIUM This Month

The ShopYourWay (aka com.sears.shopyourway) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Shopyourway
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5894 MEDIUM This Month

The AireTalk: Text, Call, & More!. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Airetalk Text Call More
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5893 MEDIUM This Month

The froyo (aka com.shinsegae.mobile.froyo) application 5.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Froyo
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5892 MEDIUM This Month

The greenbill (aka com.show.greenbill_G) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Greenbill
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5891 MEDIUM This Month

The SnipSnap Coupon App (aka com.snipsnap.snipsnapapp) application 1.1.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Snipsnap Coupon App
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5890 MEDIUM This Month

The KBO sports2i 2014 (aka com.sports2i) application 5.1.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kbo Sports2I 2014
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5889 MEDIUM This Month

The Android Forums (aka com.tapatalk.androidforumscom) application 2.4.4.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Forum For Android
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-3796 MEDIUM PATCH This Month

VMware NSX 6.0 before 6.0.6, and vCloud Networking and Security (vCNS) 5.1 before 5.1.4.2 and 5.5 before 5.5.3, does not properly validate input, which allows attackers to obtain sensitive. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.

Information Disclosure VMware Nsx Vcloud Networking And Security
NVD
CVSS 2.0
5.0
EPSS
0.5%
CVE-2014-3077 LOW Monitor

IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

IBM Information Disclosure Storwize V7000 Unified Software Storwize Unified V7000
NVD
CVSS 2.0
2.1
EPSS
0.1%
CVE-2014-2377 MEDIUM This Month

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Integraxor
NVD
CVSS 2.0
5.0
EPSS
0.5%
CVE-2014-5888 MEDIUM This Month

The SLOTS: Bible Slots Free (aka com.topfreegames.topbibleslots) application 1.122 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Slots
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5887 MEDIUM This Month

The Yell Local Search (aka com.yell.launcher2) application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Yell Local Search
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5886 MEDIUM This Month

The iVysilani ceske televize (aka cz.motion.ivysilani) application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ivysilani Ceske Televize
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5885 MEDIUM This Month

The Disaster Alert (aka disasterAlert.PDC) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Disaster Alert
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5884 MEDIUM This Month

The 1&1 Online Storage (aka de.einsundeins.smartdrive) application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure 1 1 Online Storage
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5883 MEDIUM This Month

The 7-ELEVEN (aka ecowork.seven) application 2.08.000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure 7 Eleven
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-2009 MEDIUM POC THREAT This Month

The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 12.6%.

Information Disclosure Mpay24
NVD Exploit-DB
CVSS 2.0
5.0
EPSS
12.6%
CVE-2014-3342 MEDIUM This Month

The CLI in Cisco IOS XR allows remote authenticated users to obtain sensitive information via unspecified commands, aka Bug IDs CSCuq42336, CSCuq76853, CSCuq76873, and CSCuq45383. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Apple Cisco Information Disclosure Cli Ios Xr
NVD
CVSS 2.0
4.0
EPSS
0.2%
CVE-2014-3092 MEDIUM PATCH This Month

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products,. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

IBM Information Disclosure Rational Doors Next Generation Rational Engineering Lifecycle Manager Rational Quality Manager +4
NVD
CVSS 2.0
5.0
EPSS
0.2%
CVE-2014-5882 MEDIUM This Month

The Homoo Ijiri (aka jp.co.applica) application 3.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Homoo Ijiri
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5881 MEDIUM This Month

The Yahoo!. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Yahoo Ybox
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5879 MEDIUM This Month

The tvguide (aka kenneth.tvguide) application 1.9.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Tvguide
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-6236 HIGH PATCH This Week

Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary scripts via vectors related to extension links. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.

PHP Information Disclosure Lumonet Php Include
NVD
CVSS 2.0
7.5
EPSS
2.0%
CVE-2014-6232 MEDIUM PATCH This Month

Unspecified vulnerability in the LDAP (eu_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.

Information Disclosure LDAP
NVD
CVSS 2.0
4.0
EPSS
0.3%
CVE-2014-5878 MEDIUM This Month

The ium (aka net.ium.mobile.android) application 3.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ium
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5877 MEDIUM This Month

The TV Guide (aka net.micene.minigroup.palimpsests.lite) application 5.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Tv Guide
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5876 MEDIUM This Month

The WD My Cloud (aka com.wdc.wd2go) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Wd My Cloud
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5875 MEDIUM This Month

The Sylphone (aka com.sylpheo.prospectosyl) application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Sylphone
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5874 MEDIUM This Month

The SplashID (aka com.splashidandroid) application 7.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Splashid
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5873 MEDIUM This Month

The Sears (aka com.sears.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Sears
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5872 MEDIUM This Month

The SafeNetMobile Pass (aka securecomputing.devices.android.controller) application 8.3.7.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Safenetmobile Pass
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5871 MEDIUM This Month

The Piwik Mobile 2 (aka org.piwik.mobile2) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Piwik Mobile 2
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5870 MEDIUM This Month

The Kmart (aka com.kmart.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kmart
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5869 MEDIUM This Month

The CNNMoney Portfolio (aka com.cnn.cnnmoney) application 1.03 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Cnnmoney Portfolio
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5868 MEDIUM This Month

The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Cisco Google Information Disclosure Cisco Technical Support
NVD
CVSS 2.0
5.4
EPSS
0.2%
CVE-2014-5867 MEDIUM This Month

The Capital One Spark Pay (aka com.capitalone.sparkpay) application 0.9.81 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Capital One Spark
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5866 MEDIUM This Month

The CA DMV (aka gov.ca.dmv) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ca Dmv
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5865 MEDIUM This Month

The Ask.com (aka com.ask.android) application 2.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ask Com
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5864 MEDIUM This Month

The Swish payments (aka se.bankgirot.swish) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Swish Payments
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5863 MEDIUM This Month

The mpang.gp (aka air.com.cjenm.mpang.gp) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Mpang Gp
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-0351 MEDIUM This Month

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for. Rated medium severity (CVSS 5.4). No vendor patch available.

Information Disclosure Fortinet Fortios
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-6074 MEDIUM PATCH This Month

IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.

IBM Information Disclosure Urbancode Deploy
NVD
CVSS 2.0
4.0
EPSS
0.2%
CVE-2014-5862 MEDIUM This Month

The ecalendar2 (aka cn.etouch.ecalendar2) application 4.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ecalendar2
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5861 MEDIUM This Month

The BoyAhoy - Gay Chat (aka com.boyahoy.android) application 4.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Boyahoy Gay Chat
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5860 MEDIUM This Month

The Slide Show Creator (aka com.amem) application 4.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Slide Show Creator
NVD
CVSS 2.0
5.4
EPSS
0.0%
CVE-2014-5859 MEDIUM This Month

The Star Girl: Colors of Spring (aka com.animoca.google.starGirlSpring) application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Java Star Girl
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5858 MEDIUM This Month

The Candy Blast (aka com.appgame7.candyblast) application 1.1.001 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Candy Blast
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5857 MEDIUM This Month

The White & Yellow Pages (aka com.avantar.wny) application 5.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure White Yellow Pages
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-4789 MEDIUM PATCH This Month

Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.

IBM Information Disclosure Session Fixation Initiate Master Data Service
NVD
CVSS 2.0
6.8
EPSS
0.5%
CVE-2014-4756 LOW PATCH Monitor

The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.

IBM Information Disclosure Rational License Key Server
NVD
CVSS 2.0
3.5
EPSS
0.3%
CVE-2014-0909 MEDIUM PATCH This Month

The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

IBM Information Disclosure Rational License Key Server
NVD
CVSS 2.0
5.0
EPSS
0.3%
CVE-2014-4070 MEDIUM This Month

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync XSS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 18.3% and no vendor patch available.

XSS Information Disclosure Microsoft Lync Server
NVD
CVSS 2.0
4.3
EPSS
18.3%
CVE-2014-6025 MEDIUM This Month

The Chartboost library before 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Chartboost Library
NVD
CVSS 2.0
5.4
EPSS
0.2%
CVE-2014-5856 MEDIUM This Month

The Selfie Camera -Facial Beauty- (aka com.cfinc.cunpic) application 1.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Selfie Camera Facial Beauty
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5855 MEDIUM This Month

The CJmall (aka com.cjoshppingphone) application 4.1.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Cjmall
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5854 MEDIUM This Month

The Windows Live Hotmail PUSH mail (aka com.clearhub.wl) application 1.00.97 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Microsoft Windows Live Hotmail Push Mail
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5853 MEDIUM This Month

The Knights N Squires (aka com.com2us.imhero.normal.freefull.google.global.android.common) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Knights N Squires
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5852 MEDIUM This Month

The Kakao (aka com.com2us.tinypang.kakao.freefull2.google.global.android.common) application 2.11.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kakao
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5851 MEDIUM This Month

The Dark Summoner (aka com.darksummoner) application 1.03.39 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Dark Summoner
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5850 MEDIUM This Month

The Kaave Fali (aka com.didilabs.kaavefali) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kaave Fali
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5849 MEDIUM This Month

The Maleficent Free Fall (aka com.disney.maleficent_goo) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Maleficent Free Fall
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5848 MEDIUM This Month

The Dubstep Hero (aka com.electricpunch.dubstephero) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Dubstep Hero
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5847 MEDIUM This Month

The Big Win Slots - Slot Machines (aka com.gosub60.BigWinSlots) application 1.11.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Big Win Slots Slot Machines
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5846 MEDIUM This Month

The Fairy Princess Makeover Salon (aka com.mobgams.dressup.fairy.princess.makeover) application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Fairy Princess Makeover Salon
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5845 MEDIUM This Month

The Strike Fighters Israel (aka com.thirdwire.strikefighters.mideast.android) application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Strike Fighters Israel
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5844 MEDIUM This Month

The Alsunna (aka com.wAlsunna) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Alsunna
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5843 MEDIUM This Month

The ADP AGENCY Immobiliare (aka com.wAdpagencyAndroid) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Adp Agency Immobiliare
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5842 MEDIUM This Month

The 2G Live Tv (aka com.ww2GLiveTv) application 0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure 2G Live Tv
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5841 MEDIUM This Month

The Girls Calendar Period&Weight (aka jp.co.cybird.apps.lifestyle.cal) application 3.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Girls Calendar Period Weight
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5840 MEDIUM This Month

The forfone: Free Calls & Messages (aka com.forfone.sip) forfone application 1.5.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Forfone
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5839 MEDIUM This Month

The Acces Compte (aka com.fullsix.android.labanquepostale.accountaccess) application 3.2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Acces Compte
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5838 MEDIUM This Month

The Girls Games - Shoes Maker (aka com.g6677.android.shoemaker) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Girls Games Shoes Maker
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5837 MEDIUM This Month

The My Railway (aka com.gameinsight.myrailway) application 1.1.33 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure My Railway
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5836 MEDIUM This Month

The GittiGidiyor (aka com.gittigidiyormobil) application 1.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Gittigidiyor
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5835 MEDIUM This Month

The Club Personal (aka com.globant.clubpersonal) application 2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Club Personal
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5834 MEDIUM This Month

The Solitaire Deluxe (aka com.gosub60.solfree2) application 2.8.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Solitaire Deluxe
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5833 MEDIUM This Month

The FriendCaster Chat (aka com.handmark.friendcaster.chat) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Friendcaster Chat
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5832 MEDIUM This Month

The hananbank (aka com.hanabank.ebk.channel.android.hananbank) application 4.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Hanabank
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5831 MEDIUM This Month

The Hotel Story: Resort Simulation (aka com.happylabs.hotelstory) application 1.7.9B for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Hotel Story
NVD
CVSS 2.0
5.4
EPSS
0.1%
CVE-2014-5830 MEDIUM This Month

The Farm Frenzy Gold (aka com.herocraft.game.farmfrenzy.gold) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Farm Frenzy Gold
NVD
CVSS 2.0
5.4
EPSS
0.2%
CVE-2014-5905
EPSS 0% CVSS 5.4
MEDIUM This Month

The Grocery List - Tomatoes (aka com.meucarrinho) application 5.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Grocery List Tomatoes
NVD
CVE-2014-5904
EPSS 0% CVSS 5.4
MEDIUM This Month

The MiniInTheBox Online Shopping (aka com.miniinthebox.android) application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Miniinthebox Online Shopping
NVD
CVE-2014-5903
EPSS 0% CVSS 5.4
MEDIUM This Month

The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Mobile Work
NVD
CVE-2014-5902
EPSS 0% CVSS 5.4
MEDIUM This Month

The UA Cinemas - Mobile ticketing (aka com.mtel.uacinemaapps) application 2.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ua Cinemas Mobile Ticketing
NVD
CVE-2014-5901
EPSS 0% CVSS 5.4
MEDIUM This Month

The Beauty Bible - App for Girls (aka com.my.beauty.bible) application 5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Beauty Bible App For Girls
NVD
CVE-2014-5900
EPSS 0% CVSS 5.4
MEDIUM This Month

The myHomework Student Planner (aka com.myhomeowork) application 3.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Myhomework Student Planner
NVD
CVE-2014-5899
EPSS 0% CVSS 5.4
MEDIUM This Month

The Nespresso (aka com.nespresso.activities) application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Nespresso
NVD
CVE-2014-5898
EPSS 0% CVSS 5.4
MEDIUM This Month

The Heavy Duty Truck Driver Simulator 3D (aka com.oas.heavy.duty.truck.driver.simulator3d) application 1.0.5 for Android does not verify X.509 certificates from SSL servers, which allows. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Heavy Duty Truck Driver Simulator 3D
NVD
CVE-2014-5897
EPSS 0% CVSS 5.4
MEDIUM This Month

The Parallel Mafia MMORPG (aka com.perblue.pm.client) application @7F070000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Parallel Mafia Mmorpg
NVD
CVE-2014-5896
EPSS 0% CVSS 5.4
MEDIUM This Month

The GlobalTalk- free phone calls (aka com.seawolftech.globaltalk) application 2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Globaltalk Free Phone Calls
NVD
CVE-2014-5895
EPSS 0% CVSS 5.4
MEDIUM This Month

The ShopYourWay (aka com.sears.shopyourway) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Shopyourway
NVD
CVE-2014-5894
EPSS 0% CVSS 5.4
MEDIUM This Month

The AireTalk: Text, Call, & More!. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Airetalk Text Call More
NVD
CVE-2014-5893
EPSS 0% CVSS 5.4
MEDIUM This Month

The froyo (aka com.shinsegae.mobile.froyo) application 5.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Froyo
NVD
CVE-2014-5892
EPSS 0% CVSS 5.4
MEDIUM This Month

The greenbill (aka com.show.greenbill_G) application 2.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Greenbill
NVD
CVE-2014-5891
EPSS 0% CVSS 5.4
MEDIUM This Month

The SnipSnap Coupon App (aka com.snipsnap.snipsnapapp) application 1.1.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Snipsnap Coupon App
NVD
CVE-2014-5890
EPSS 0% CVSS 5.4
MEDIUM This Month

The KBO sports2i 2014 (aka com.sports2i) application 5.1.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kbo Sports2I 2014
NVD
CVE-2014-5889
EPSS 0% CVSS 5.4
MEDIUM This Month

The Android Forums (aka com.tapatalk.androidforumscom) application 2.4.4.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Forum For Android
NVD
CVE-2014-3796
EPSS 0% CVSS 5.0
MEDIUM PATCH This Month

VMware NSX 6.0 before 6.0.6, and vCloud Networking and Security (vCNS) 5.1 before 5.1.4.2 and 5.5 before 5.5.3, does not properly validate input, which allows attackers to obtain sensitive. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.

Information Disclosure VMware Nsx +1
NVD
CVE-2014-3077
EPSS 0% CVSS 2.1
LOW Monitor

IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.

IBM Information Disclosure Storwize V7000 Unified Software +1
NVD
CVE-2014-2377
EPSS 1% CVSS 5.0
MEDIUM This Month

Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to discover full pathnames via an application tag. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Information Disclosure Integraxor
NVD
CVE-2014-5888
EPSS 0% CVSS 5.4
MEDIUM This Month

The SLOTS: Bible Slots Free (aka com.topfreegames.topbibleslots) application 1.122 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Slots
NVD
CVE-2014-5887
EPSS 0% CVSS 5.4
MEDIUM This Month

The Yell Local Search (aka com.yell.launcher2) application 4.2.1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Yell Local Search
NVD
CVE-2014-5886
EPSS 0% CVSS 5.4
MEDIUM This Month

The iVysilani ceske televize (aka cz.motion.ivysilani) application 1.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ivysilani Ceske Televize
NVD
CVE-2014-5885
EPSS 0% CVSS 5.4
MEDIUM This Month

The Disaster Alert (aka disasterAlert.PDC) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Disaster Alert
NVD
CVE-2014-5884
EPSS 0% CVSS 5.4
MEDIUM This Month

The 1&1 Online Storage (aka de.einsundeins.smartdrive) application 5.0.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure 1 1 Online Storage
NVD
CVE-2014-5883
EPSS 0% CVSS 5.4
MEDIUM This Month

The 7-ELEVEN (aka ecowork.seven) application 2.08.000 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure 7 Eleven
NVD
CVE-2014-2009
EPSS 13% CVSS 5.0
MEDIUM POC THREAT This Month

The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 12.6%.

Information Disclosure Mpay24
NVD Exploit-DB
CVE-2014-3342
EPSS 0% CVSS 4.0
MEDIUM This Month

The CLI in Cisco IOS XR allows remote authenticated users to obtain sensitive information via unspecified commands, aka Bug IDs CSCuq42336, CSCuq76853, CSCuq76873, and CSCuq45383. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Apple Cisco Information Disclosure +2
NVD
CVE-2014-3092
EPSS 0% CVSS 5.0
MEDIUM PATCH This Month

IBM Jazz Team Server, as used in Rational Collaborative Lifecycle Management; Rational Quality Manager 3.x before 3.0.1.6 iFix 3, 4.x before 4.0.7, and 5.x before 5.0.1; and other Rational products,. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

IBM Information Disclosure Rational Doors Next Generation +6
NVD
CVE-2014-5882
EPSS 0% CVSS 5.4
MEDIUM This Month

The Homoo Ijiri (aka jp.co.applica) application 3.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Homoo Ijiri
NVD
CVE-2014-5881
EPSS 0% CVSS 5.4
MEDIUM This Month

The Yahoo!. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Yahoo Ybox
NVD
CVE-2014-5879
EPSS 0% CVSS 5.4
MEDIUM This Month

The tvguide (aka kenneth.tvguide) application 1.9.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Tvguide
NVD
CVE-2014-6236
EPSS 2% CVSS 7.5
HIGH PATCH This Week

Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary scripts via vectors related to extension links. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity.

PHP Information Disclosure Lumonet Php Include
NVD
CVE-2014-6232
EPSS 0% CVSS 4.0
MEDIUM PATCH This Month

Unspecified vulnerability in the LDAP (eu_ldap) extension before 2.8.18 for TYPO3 allows remote authenticated users to obtain sensitive information via unknown vectors. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.

Information Disclosure LDAP
NVD
CVE-2014-5878
EPSS 0% CVSS 5.4
MEDIUM This Month

The ium (aka net.ium.mobile.android) application 3.3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ium
NVD
CVE-2014-5877
EPSS 0% CVSS 5.4
MEDIUM This Month

The TV Guide (aka net.micene.minigroup.palimpsests.lite) application 5.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Tv Guide
NVD
CVE-2014-5876
EPSS 0% CVSS 5.4
MEDIUM This Month

The WD My Cloud (aka com.wdc.wd2go) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Wd My Cloud
NVD
CVE-2014-5875
EPSS 0% CVSS 5.4
MEDIUM This Month

The Sylphone (aka com.sylpheo.prospectosyl) application 5.3.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Sylphone
NVD
CVE-2014-5874
EPSS 0% CVSS 5.4
MEDIUM This Month

The SplashID (aka com.splashidandroid) application 7.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Splashid
NVD
CVE-2014-5873
EPSS 0% CVSS 5.4
MEDIUM This Month

The Sears (aka com.sears.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Sears
NVD
CVE-2014-5872
EPSS 0% CVSS 5.4
MEDIUM This Month

The SafeNetMobile Pass (aka securecomputing.devices.android.controller) application 8.3.7.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Safenetmobile Pass
NVD
CVE-2014-5871
EPSS 0% CVSS 5.4
MEDIUM This Month

The Piwik Mobile 2 (aka org.piwik.mobile2) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Piwik Mobile 2
NVD
CVE-2014-5870
EPSS 0% CVSS 5.4
MEDIUM This Month

The Kmart (aka com.kmart.android) application 6.2.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kmart
NVD
CVE-2014-5869
EPSS 0% CVSS 5.4
MEDIUM This Month

The CNNMoney Portfolio (aka com.cnn.cnnmoney) application 1.03 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Cnnmoney Portfolio
NVD
CVE-2014-5868
EPSS 0% CVSS 5.4
MEDIUM This Month

The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Cisco Google Information Disclosure +1
NVD
CVE-2014-5867
EPSS 0% CVSS 5.4
MEDIUM This Month

The Capital One Spark Pay (aka com.capitalone.sparkpay) application 0.9.81 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Capital One Spark
NVD
CVE-2014-5866
EPSS 0% CVSS 5.4
MEDIUM This Month

The CA DMV (aka gov.ca.dmv) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ca Dmv
NVD
CVE-2014-5865
EPSS 0% CVSS 5.4
MEDIUM This Month

The Ask.com (aka com.ask.android) application 2.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ask Com
NVD
CVE-2014-5864
EPSS 0% CVSS 5.4
MEDIUM This Month

The Swish payments (aka se.bankgirot.swish) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Swish Payments
NVD
CVE-2014-5863
EPSS 0% CVSS 5.4
MEDIUM This Month

The mpang.gp (aka air.com.cjenm.mpang.gp) application 4.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Mpang Gp
NVD
CVE-2014-0351
EPSS 0% CVSS 5.4
MEDIUM This Month

The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.x before 5.0.8 on FortiGate devices does not prevent use of anonymous ciphersuites, which makes it easier for. Rated medium severity (CVSS 5.4). No vendor patch available.

Information Disclosure Fortinet Fortios
NVD
CVE-2014-6074
EPSS 0% CVSS 4.0
MEDIUM PATCH This Month

IBM UrbanCode Deploy 6.1.0.2 before IF1 allows remote authenticated users to read keystore secret keys via a direct request to a UI page. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity.

IBM Information Disclosure Urbancode Deploy
NVD
CVE-2014-5862
EPSS 0% CVSS 5.4
MEDIUM This Month

The ecalendar2 (aka cn.etouch.ecalendar2) application 4.5.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Ecalendar2
NVD
CVE-2014-5861
EPSS 0% CVSS 5.4
MEDIUM This Month

The BoyAhoy - Gay Chat (aka com.boyahoy.android) application 4.3.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Boyahoy Gay Chat
NVD
CVE-2014-5860
EPSS 0% CVSS 5.4
MEDIUM This Month

The Slide Show Creator (aka com.amem) application 4.4.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Slide Show Creator
NVD
CVE-2014-5859
EPSS 0% CVSS 5.4
MEDIUM This Month

The Star Girl: Colors of Spring (aka com.animoca.google.starGirlSpring) application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Java +1
NVD
CVE-2014-5858
EPSS 0% CVSS 5.4
MEDIUM This Month

The Candy Blast (aka com.appgame7.candyblast) application 1.1.001 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Candy Blast
NVD
CVE-2014-5857
EPSS 0% CVSS 5.4
MEDIUM This Month

The White & Yellow Pages (aka com.avantar.wny) application 5.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure White Yellow Pages
NVD
CVE-2014-4789
EPSS 0% CVSS 6.8
MEDIUM PATCH This Month

Session fixation vulnerability in IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 allows remote attackers to hijack. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.

IBM Information Disclosure Session Fixation +1
NVD
CVE-2014-4756
EPSS 0% CVSS 3.5
LOW PATCH Monitor

The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 allows remote authenticated users to hijack sessions via unspecified vectors. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable.

IBM Information Disclosure Rational License Key Server
NVD
CVE-2014-0909
EPSS 0% CVSS 5.0
MEDIUM PATCH This Month

The Administration and Reporting Tool in IBM Rational License Key Server (RLKS) 8.1.4.x before 8.1.4.4 does not set the secure flag for the session cookie in an https session, which makes it easier. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

IBM Information Disclosure Rational License Key Server
NVD
CVE-2014-4070
EPSS 18% CVSS 4.3
MEDIUM This Month

Cross-site scripting (XSS) vulnerability in the Web Components Server in Microsoft Lync Server 2013 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Lync XSS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Epss exploitation probability 18.3% and no vendor patch available.

XSS Information Disclosure Microsoft +1
NVD
CVE-2014-6025
EPSS 0% CVSS 5.4
MEDIUM This Month

The Chartboost library before 2.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Chartboost Library
NVD
CVE-2014-5856
EPSS 0% CVSS 5.4
MEDIUM This Month

The Selfie Camera -Facial Beauty- (aka com.cfinc.cunpic) application 1.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Selfie Camera Facial Beauty
NVD
CVE-2014-5855
EPSS 0% CVSS 5.4
MEDIUM This Month

The CJmall (aka com.cjoshppingphone) application 4.1.8 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Cjmall
NVD
CVE-2014-5854
EPSS 0% CVSS 5.4
MEDIUM This Month

The Windows Live Hotmail PUSH mail (aka com.clearhub.wl) application 1.00.97 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Microsoft +1
NVD
CVE-2014-5853
EPSS 0% CVSS 5.4
MEDIUM This Month

The Knights N Squires (aka com.com2us.imhero.normal.freefull.google.global.android.common) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Knights N Squires
NVD
CVE-2014-5852
EPSS 0% CVSS 5.4
MEDIUM This Month

The Kakao (aka com.com2us.tinypang.kakao.freefull2.google.global.android.common) application 2.11.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kakao
NVD
CVE-2014-5851
EPSS 0% CVSS 5.4
MEDIUM This Month

The Dark Summoner (aka com.darksummoner) application 1.03.39 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Dark Summoner
NVD
CVE-2014-5850
EPSS 0% CVSS 5.4
MEDIUM This Month

The Kaave Fali (aka com.didilabs.kaavefali) application 1.5.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Kaave Fali
NVD
CVE-2014-5849
EPSS 0% CVSS 5.4
MEDIUM This Month

The Maleficent Free Fall (aka com.disney.maleficent_goo) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Maleficent Free Fall
NVD
CVE-2014-5848
EPSS 0% CVSS 5.4
MEDIUM This Month

The Dubstep Hero (aka com.electricpunch.dubstephero) application 1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Dubstep Hero
NVD
CVE-2014-5847
EPSS 0% CVSS 5.4
MEDIUM This Month

The Big Win Slots - Slot Machines (aka com.gosub60.BigWinSlots) application 1.11.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Big Win Slots Slot Machines
NVD
CVE-2014-5846
EPSS 0% CVSS 5.4
MEDIUM This Month

The Fairy Princess Makeover Salon (aka com.mobgams.dressup.fairy.princess.makeover) application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Fairy Princess Makeover Salon
NVD
CVE-2014-5845
EPSS 0% CVSS 5.4
MEDIUM This Month

The Strike Fighters Israel (aka com.thirdwire.strikefighters.mideast.android) application 1.2.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Strike Fighters Israel
NVD
CVE-2014-5844
EPSS 0% CVSS 5.4
MEDIUM This Month

The Alsunna (aka com.wAlsunna) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Alsunna
NVD
CVE-2014-5843
EPSS 0% CVSS 5.4
MEDIUM This Month

The ADP AGENCY Immobiliare (aka com.wAdpagencyAndroid) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Adp Agency Immobiliare
NVD
CVE-2014-5842
EPSS 0% CVSS 5.4
MEDIUM This Month

The 2G Live Tv (aka com.ww2GLiveTv) application 0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure 2G Live Tv
NVD
CVE-2014-5841
EPSS 0% CVSS 5.4
MEDIUM This Month

The Girls Calendar Period&Weight (aka jp.co.cybird.apps.lifestyle.cal) application 3.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Girls Calendar Period Weight
NVD
CVE-2014-5840
EPSS 0% CVSS 5.4
MEDIUM This Month

The forfone: Free Calls & Messages (aka com.forfone.sip) forfone application 1.5.11 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Forfone
NVD
CVE-2014-5839
EPSS 0% CVSS 5.4
MEDIUM This Month

The Acces Compte (aka com.fullsix.android.labanquepostale.accountaccess) application 3.2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Acces Compte
NVD
CVE-2014-5838
EPSS 0% CVSS 5.4
MEDIUM This Month

The Girls Games - Shoes Maker (aka com.g6677.android.shoemaker) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Girls Games Shoes Maker
NVD
CVE-2014-5837
EPSS 0% CVSS 5.4
MEDIUM This Month

The My Railway (aka com.gameinsight.myrailway) application 1.1.33 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure My Railway
NVD
CVE-2014-5836
EPSS 0% CVSS 5.4
MEDIUM This Month

The GittiGidiyor (aka com.gittigidiyormobil) application 1.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Gittigidiyor
NVD
CVE-2014-5835
EPSS 0% CVSS 5.4
MEDIUM This Month

The Club Personal (aka com.globant.clubpersonal) application 2.6 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Club Personal
NVD
CVE-2014-5834
EPSS 0% CVSS 5.4
MEDIUM This Month

The Solitaire Deluxe (aka com.gosub60.solfree2) application 2.8.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Solitaire Deluxe
NVD
CVE-2014-5833
EPSS 0% CVSS 5.4
MEDIUM This Month

The FriendCaster Chat (aka com.handmark.friendcaster.chat) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Friendcaster Chat
NVD
CVE-2014-5832
EPSS 0% CVSS 5.4
MEDIUM This Month

The hananbank (aka com.hanabank.ebk.channel.android.hananbank) application 4.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Hanabank
NVD
CVE-2014-5831
EPSS 0% CVSS 5.4
MEDIUM This Month

The Hotel Story: Resort Simulation (aka com.happylabs.hotelstory) application 1.7.9B for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Hotel Story
NVD
CVE-2014-5830
EPSS 0% CVSS 5.4
MEDIUM This Month

The Farm Frenzy Gold (aka com.herocraft.game.farmfrenzy.gold) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof. Rated medium severity (CVSS 5.4). No vendor patch available.

Google Information Disclosure Farm Frenzy Gold
NVD
Prev Page 747 of 789 Next

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy