deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3529
Published: 2014-09-04
Description: The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVSS Score: 4.3 (MEDIUM)
References: http://poi.apache.org/changes.html; http://rhn.redhat.com/errata/RHSA-2014-1370.html; http://rhn.redhat.com/errata/RHSA-2014-1398.html
CVE: CVE-2014-3574
Published: 2014-09-04
Description: Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVSS Score: 4.3 (MEDIUM)
References: http://poi.apache.org/changes.html; http://rhn.redhat.com/errata/RHSA-2014-1370.html; http://rhn.redhat.com/errata/RHSA-2014-1398.html
CVE: CVE-2014-5269
Published: 2014-09-04
Description: Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://api.metacpan.org/source/MIYAGAWA/Plack-1.0031/Changes; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137099.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137115.html
CVE: CVE-2014-5377
Published: 2014-09-04
Description: ReadUsersFromMasterServlet in ManageEngine DeviceExpert before 5.9 build 5981 allows remote attackers to obtain user account credentials via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/128019/ManageEngine-DeviceExpert-5.9-Credential-Disclosure.html; http://seclists.org/fulldisclosure/2014/Aug/75; http://seclists.org/fulldisclosure/2014/Aug/76
CVE: CVE-2014-5461
Published: 2014-09-04
Description: Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0414.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00030.html; http://secunia.com/advisories/59890
CVE: CVE-2014-5504
Published: 2014-09-04
Description: SolarWinds Log and Event Manager before 6.0 uses "static" credentials, which makes it easier for remote attackers to obtain access to the database and execute arbitrary code via unspecified vectors, related to HyperSQL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htm; http://www.zerodayinitiative.com/advisories/ZDI-14-303/; http://www.solarwinds.com/documentation/lem/docs/releasenotes/releasenotes.htm
CVE: CVE-2014-5505
Published: 2014-09-04
Description: Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/60877; http://www.securityfocus.com/bid/69558
CVE: CVE-2014-5506
Published: 2014-09-04
Description: Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file.
CVSS Score: 6.8 (MEDIUM)
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/61016; http://www.securityfocus.com/bid/69557
CVE: CVE-2014-6060
Published: 2014-09-04
Description: The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section, which triggers the option to be processed again.
CVSS Score: 3.3 (LOW)
CWE: CWE-399
References: http://advisories.mageia.org/MGASA-2014-0334.html; http://roy.marples.name/projects/dhcpcd/ci/1d2b93aa5ce25a8a710082fe2d36a6bf7f5794d5?sbs=0; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2014-0610
Published: 2014-09-05
Description: The client in Novell GroupWise before 8.0.3 HP4, 2012 before SP3, and 2014 before SP1 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (invalid pointer dereference) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.novell.com/support/kb/doc.php?id=7015565; http://www.securitytracker.com/id/1030802; https://bugzilla.novell.com/show_bug.cgi?id=874533
CVE: CVE-2014-0863
Published: 2014-09-05
Description: The client in IBM Cognos TM1 9.5.2.3 before IF5, 10.1.1.2 before IF1, 10.2.0.2 before IF1, and 10.2.2.0 before IF1 stores obfuscated passwords in memory, which allows remote authenticated users to obtain sensitive cleartext information via an unspecified security tool.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg21682397; http://www.securityfocus.com/bid/69594; http://www.securitytracker.com/id/1030805
CVE: CVE-2014-5036
Published: 2014-09-05
Description: The Storage Controller (SC) component in Eucalyptus 3.4.2 through 4.0.x before 4.0.1, when Dell Equallogic SAN is used, logs the CHAP user credentials, which allows local users to obtain sensitive information by reading the logs.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/60359; http://secunia.com/advisories/60712; https://www.eucalyptus.com/resources/security/advisories/esa-23
CVE: CVE-2014-5508
Published: 2014-09-05
Description: Multiple integer overflows in the HelpServ module (mod-helpserv.c) in srvx 1.3.1 allow remote authenticated IRCops or HelpServ bot managers to cause a denial of service (infinite loop) via a large value in the EmptyInterval parameter or certain other interval configurations.
CVSS Score: 3.5 (LOW)
CWE: CWE-189
References: http://www.openwall.com/lists/oss-security/2014/08/28/5; http://www.openwall.com/lists/oss-security/2014/08/30/1; http://www.securityfocus.com/bid/69454
CVE: CVE-2014-6028
Published: 2014-09-05
Description: TorrentFlux 2.4 allows remote authenticated users to obtain other users' cookies via the cid parameter in an editCookies action to profile.php.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/08/29/5; http://www.openwall.com/lists/oss-security/2014/09/02/3; http://www.securitytracker.com/id/1030791
CVE: CVE-2014-6029
Published: 2014-09-05
Description: TorrentFlux 2.4 allows remote authenticated users to delete or modify other users' cookies via the cid parameter in an editCookies action to profile.php.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-20
References: http://www.openwall.com/lists/oss-security/2014/08/29/5; http://www.openwall.com/lists/oss-security/2014/09/02/3; http://www.securitytracker.com/id/1030791
CVE: CVE-2014-6252
Published: 2014-09-05
Description: Buffer overflow in disp+work.exe 7000.52.12.34966 and 7200.117.19.50294 in the Dispatcher in SAP NetWeaver 7.00 and 7.20 allows remote authenticated users to cause a denial of service or execute arbitrary code via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://scn.sap.com/docs/DOC-8218; http://secunia.com/advisories/60496; https://erpscan.io/advisories/erpscan-14-011-sap-netweaver-dispatcher-buffer-overflow-rce-dos/
CVE: CVE-2014-0877
Published: 2014-09-05
Description: IBM Cognos TM1 10.2.0.2 before IF1 and 10.2.2.0 before IF1 allows remote attackers to bypass intended access restrictions by visiting the Rights page and then following a generated link.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21682395; https://exchange.xforce.ibmcloud.com/vulnerabilities/91064; http://www-01.ibm.com/support/docview.wss?uid=swg21682395
CVE: CVE-2014-2378
Published: 2014-09-05
Description: Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-494, CWE-94
References: http://www.sensysnetworks.com/distributors/; http://www.sensysnetworks.com/resources-by-category/#sw; https://www.cisa.gov/news-events/ics-advisories/icsa-14-247-01a
CVE: CVE-2014-2379
Published: 2014-09-05
Description: Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-311, CWE-310
References: http://www.sensysnetworks.com/distributors/; http://www.sensysnetworks.com/resources-by-category/#sw; https://www.cisa.gov/news-events/ics-advisories/icsa-14-247-01a
CVE: CVE-2014-3909
Published: 2014-09-05
Description: Session fixation vulnerability in Falcon WisePoint 4.1.19.7 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://jvn.jp/en/jp/JVN49672671/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000084; https://service.falconsc.com/service/product/patch/index.html
CVE: CVE-2014-3910
Published: 2014-09-05
Description: Emurasoft EmFTP allows local users to gain privileges via a Trojan horse executable file that is launched during an attempt to read a similarly named file that lacks a filename extension.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN50367052/995292/index.html; http://jvn.jp/en/jp/JVN50367052/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2014-000103
CVE: CVE-2014-4862
Published: 2014-09-05
Description: The Netmaster CBW700N cable modem with software 81.447.392110.729.024 has an SNMP community of public, which allows remote attackers to obtain sensitive credential, key, and SSID information via an SNMP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/259548; https://community.rapid7.com/community/metasploit/blog/2014/08/21/more-snmp-information-leaks-cve-2014-4862-and-cve-2014-4863; http://www.kb.cert.org/vuls/id/259548
CVE: CVE-2014-4863
Published: 2014-09-05
Description: The Arris Touchstone DG950A cable modem with software 7.10.131 has an SNMP community of public, which allows remote attackers to obtain sensitive password, key, and SSID information via an SNMP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.kb.cert.org/vuls/id/855836; https://community.rapid7.com/community/metasploit/blog/2014/08/21/more-snmp-information-leaks-cve-2014-4862-and-cve-2014-4863; http://www.kb.cert.org/vuls/id/855836
CVE: CVE-2014-5256
Published: 2014-09-05
Description: Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://advisories.mageia.org/MGASA-2014-0516.html; http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/; http://secunia.com/advisories/61260
CVE: CVE-2014-0152
Published: 2014-09-08
Description: Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://gerrit.ovirt.org/#/c/25959/; http://www.ovirt.org/Security_advisories; http://gerrit.ovirt.org/#/c/25959/
CVE: CVE-2014-0153
Published: 2014-09-08
Description: The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://gerrit.ovirt.org/#/c/25987/; http://www.ovirt.org/Security_advisories; http://gerrit.ovirt.org/#/c/25987/
CVE: CVE-2014-3618
Published: 2014-09-08
Description: Heap-based buffer overflow in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted email header, related to "unbalanced quotes."
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://linux.oracle.com/errata/ELSA-2014-1172.html; http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html; http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00008.html
CVE: CVE-2014-5369
Published: 2014-09-08
Description: Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-updates/2014-09/msg00004.html; http://lists.opensuse.org/opensuse-updates/2014-09/msg00008.html; http://secunia.com/advisories/60779
CVE: CVE-2014-5464
Published: 2014-09-08
Description: Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/show/osvdb/110437; http://packetstormsecurity.com/files/127995/ntopng-1.2.0-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2014/Aug/65
CVE: CVE-2014-5524
Published: 2014-09-09
Description: The Adcolony library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/199345; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5525
Published: 2014-09-09
Description: The MoMinis library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/935465; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5526
Published: 2014-09-09
Description: The Inmobi library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/571145; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5527
Published: 2014-09-09
Description: The Tapjoy library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/123577; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5528
Published: 2014-09-09
Description: The Appsflyer library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/157457; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5529
Published: 2014-09-09
Description: The Gameloft library for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/943033; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5530
Published: 2014-09-09
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2014-5754, CVE-2014-5755, CVE-2014-8538.  Reason: This candidate is a duplicate of CVE-2014-5754, CVE-2014-5755, and CVE-2014-8538.  Further investigation showed that an applicable library product did not exist.  Notes: All CVE users should reference CVE-2014-5754, CVE-2014-5755, and/or CVE-2014-8538 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2014-5531
Published: 2014-09-09
Description: The Abode (aka abode.webview) application 1.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/371825; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5532
Published: 2014-09-09
Description: The Honolulu (aka adidas.jp.android.running.honolulu) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/748553; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5534
Published: 2014-09-09
Description: The Princess Shopping (aka air.android.PrincessShopping) application 2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/991961; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5535
Published: 2014-09-09
Description: The Baby Get Up - Kids Care (aka air.brown.jordansa.getup) application 1.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/946729; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5536
Published: 2014-09-09
Description: The Bingo Bash - Free Bingo Casino (aka air.com.bitrhymes.bingo) application 1.31.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/960369; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5537
Published: 2014-09-09
Description: The Abduction Stacker Free (aka air.com.chewygames.abductionstacker2) application 1.0.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/736145; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5538
Published: 2014-09-09
Description: The Westmoreland Water FCU (aka air.com.creditunionhomebanking.mb115) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/114601; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5539
Published: 2014-09-09
Description: The Michael Baker FCU (aka air.com.creditunionhomebanking.mb155) application 1.2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/947785; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5540
Published: 2014-09-09
Description: The Flick a Trade (aka air.com.cygnecode.fat) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/113105; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5541
Published: 2014-09-09
Description: The Hidden Memory - Aladdin FREE! (aka air.com.differencegames.hmaladdinfree) application 1.0.31 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/636617; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5542
Published: 2014-09-09
Description: The Hidden Object Mystery (aka air.com.differencegames.hodetectivemysteryfree) application 1.0.65 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/638641; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5543
Published: 2014-09-09
Description: The Hidden Object - Alice Free (aka air.com.differencegames.hovisionsofalicefree) application 1.0.17 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/171273; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-5544
Published: 2014-09-09
Description: The SongPop (aka air.com.freshplanet.games.WaM) application 1.21.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/533657; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing