deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-6551
Published: 2014-10-15
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.38 and earlier and 5.6.19 and earlier allows local users to affect confidentiality via vectors related to CLIENT:MYSQLADMIN.
CVSS Score: 2.1 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html; http://www.oracle.com/technetwork/topics/security/bulletinoct2[PII_REDACTED].html; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html
CVE: CVE-2014-6552
Published: 2014-10-15
Description: Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect integrity via unknown vectors related to Admin Console.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/61767; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70452
CVE: CVE-2014-6553
Published: 2014-10-15
Description: Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Admin Console.
CVSS Score: 6.4 (MEDIUM)
References: http://secunia.com/advisories/61767; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70483
CVE: CVE-2014-6554
Published: 2014-10-15
Description: Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.1 and 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console.
CVSS Score: 5.5 (MEDIUM)
References: http://secunia.com/advisories/61767; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70494
CVE: CVE-2014-6555
Published: 2014-10-15
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html; http://secunia.com/advisories/61579; http://secunia.com/advisories/62073
CVE: CVE-2014-6557
Published: 2014-10-15
Description: Unspecified vulnerability in the Application Performance Management component in Oracle Enterprise Manager Grid Control before 12.1.0.6.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to End User Experience Management.
CVSS Score: 4.9 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70512; http://www.securitytracker.com/id/1031041
CVE: CVE-2014-6558
Published: 2014-10-15
Description: Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.
CVSS Score: 2.6 (LOW)
References: http://linux.oracle.com/errata/ELSA-2014-1633.html; http://linux.oracle.com/errata/ELSA-2014-1634.html; http://linux.oracle.com/errata/ELSA-2014-1636
CVE: CVE-2014-6559
Published: 2014-10-15
Description: Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.
CVSS Score: 4.3 (MEDIUM)
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10698; http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html; http://secunia.com/advisories/61579
CVE: CVE-2014-6560
Published: 2014-10-15
Description: Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-6453, CVE-2014-6467, and CVE-2014-6545.
CVSS Score: 9.0 (HIGH)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70482; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html
CVE: CVE-2014-6561
Published: 2014-10-15
Description: Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 12.0.4, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Separate Remittance Advice.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/61781; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70454
CVE: CVE-2014-6562
Published: 2014-10-15
Description: Unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSS Score: 9.3 (HIGH)
References: http://linux.oracle.com/errata/ELSA-2014-1636; http://rhn.redhat.com/errata/RHSA-2014-1636.html; http://secunia.com/advisories/60416
CVE: CVE-2014-6563
Published: 2014-10-15
Description: Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4294, CVE-2014-4295, and CVE-2014-6538.
CVSS Score: 4.0 (MEDIUM)
References: http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70465; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html
CVE: CVE-2014-6564
Published: 2014-10-15
Description: Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB FULLTEXT SEARCH DML.
CVSS Score: 4.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00016.html; http://www.oracle.com/technetwork/topics/security/cpuoct2[PII_REDACTED].html; http://www.securityfocus.com/bid/70511
CVE: CVE-2014-3686
Published: 2014-10-16
Description: wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://advisories.mageia.org/MGASA-2014-0429.html; http://lists.opensuse.org/opensuse-security-announce/2014-11/msg00000.html; http://lists.opensuse.org/opensuse-updates/2014-10/msg00027.html
CVE: CVE-2014-3704
Published: 2014-10-16
Description: The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/show/osvdb/113371; http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html; http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html
CVE: CVE-2014-7237
Published: 2014-10-16
Description: lib/TWiki/Sandbox.pm in TWiki 6.0.0 and earlier, when running on Windows, allows remote attackers to bypass intended access restrictions and upload files with restricted names via a null byte (%00) in a filename to bin/upload.cgi, as demonstrated using .htaccess to execute arbitrary code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://seclists.org/fulldisclosure/2014/Oct/45; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-7237; http://www.securitytracker.com/id/1030982
CVE: CVE-2014-8296
Published: 2014-10-16
Description: Cross-site scripting (XSS) vulnerability in the Modal Frame API module 6.x-1.x before 6.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/102909; https://exchange.xforce.ibmcloud.com/vulnerabilities/90972; https://www.drupal.org/node/2189751
CVE: CVE-2014-3661
Published: 2014-10-16
Description: Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01; https://access.redhat.com/errata/RHSA-2016:0070
CVE: CVE-2014-3662
Published: 2014-10-16
Description: Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01; https://access.redhat.com/errata/RHSA-2016:0070
CVE: CVE-2014-3663
Published: 2014-10-16
Description: Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01; https://access.redhat.com/errata/RHSA-2016:0070
CVE: CVE-2014-3666
Published: 2014-10-16
Description: Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01; https://access.redhat.com/errata/RHSA-2016:0070
CVE: CVE-2014-3667
Published: 2014-10-16
Description: Jenkins before 1.583 and LTS before 1.565.3 does not properly prevent downloading of plugins, which allows remote authenticated users with the Overall/READ permission to obtain sensitive information by reading the plugin code.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01; https://access.redhat.com/errata/RHSA-2016:0070
CVE: CVE-2014-3679
Published: 2014-10-16
Description: The Monitoring plugin before 1.53.0 for Jenkins allows remote attackers to obtain sensitive information by accessing unspecified pages.
CVSS Score: 5.0 (MEDIUM)
References: https://wiki.jenkins-ci.org/display/JENKINS/Monitoring; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01; https://wiki.jenkins-ci.org/display/JENKINS/Monitoring
CVE: CVE-2014-3680
Published: 2014-10-16
Description: Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2016:0070; https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-10-01; https://access.redhat.com/errata/RHSA-2016:0070
CVE: CVE-2014-4881
Published: 2014-10-16
Description: The PartyTrack library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/230145; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6953
Published: 2014-10-16
Description: The AFTERLIFE WITH ARCHIE (aka com.afterlifewitharchie.afterlifewitharchie) application 2.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/495025; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6954
Published: 2014-10-16
Description: The Deer Hunting Calls + Guide (aka com.anawaz.deerhuntingcalls.free) application 4.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/289545; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6955
Published: 2014-10-16
Description: The Le Grand Bleu (aka com.appzone468) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/988001; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6956
Published: 2014-10-16
Description: The Hydrogen Water (aka com.appzone628) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/735617; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6957
Published: 2014-10-16
Description: The scottcolibmn (aka com.bredir.boopsie.scottlib) application 4.5.110 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/354841; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6958
Published: 2014-10-16
Description: The ISMRM-ESMRMB 2014 (aka com.coreapps.android.followme.ismrm_esmrmb14) application 6.0.8.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/644449; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6959
Published: 2014-10-16
Description: The QinCard (aka com.haowan.qincard) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/199609; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6960
Published: 2014-10-16
Description: The Multitrac (aka com.multitrac) application 1.04 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/730073; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6961
Published: 2014-10-16
Description: The SudaniNet (aka com.sudaninet.wtwqiqbegq_btwlda) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/315505; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6962
Published: 2014-10-16
Description: The Elk Grove PublicStuff (aka com.wassabi.elkgrove) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/366457; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6963
Published: 2014-10-16
Description: The feiron (aka es.sw.feironmobile.app) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/269921; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6964
Published: 2014-10-16
Description: The Hanyang University Admissions (aka kr.ac.hanyang.planner) application 2.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/589273; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6965
Published: 2014-10-16
Description: The FAZ.NET (aka net.faz.FAZ) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/824761; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6966
Published: 2014-10-16
Description: The West Bend School District (aka net.parentlink.westbend) application 4.0.500 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/402889; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6967
Published: 2014-10-16
Description: The Albion College (aka com.vivomobile.albioncollege) application 2.1.16 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/732185; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6968
Published: 2014-10-16
Description: The Grandma's Grotto (aka com.mobileappsuite.grandmasgrotto) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/113545; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6969
Published: 2014-10-16
Description: The Deltin Suites (aka com.DeltinSuites) application 3.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/130265; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6970
Published: 2014-10-16
Description: The North American Ismaili Games (aka hr.apps.n166983741) application 5.26.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/795545; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6971
Published: 2014-10-16
Description: The Easy Video Downloader (aka com.simon.padillar.EasyVideo) application 4.4.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/921561; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6972
Published: 2014-10-16
Description: The Kazakhstan Radio (aka com.wordbox.kazakhstanRadio) application 2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/751369; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6973
Published: 2014-10-16
Description: The Care4Kids (aka com.codetherapy.care4kids) application 1.03 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/543689; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6974
Published: 2014-10-16
Description: The MifaShow Hairstyles (aka com.mifashow) application 3.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/827401; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-6975
Published: 2014-10-16
Description: The Twin Lin (aka com.twinlin.twmo) application 5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/913201; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing