deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5865
Published: 2014-10-20
Description: SQL injection vulnerability in dispatch.php in Achievo 1.4.5 allows remote authenticated users to execute arbitrary SQL commands via the activityid parameter in a stats action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/88184; http://packetstormsecurity.com/files/118673/Achievo-1.4.5-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/56858
CVE: CVE-2012-5866
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in include.php in Achievo 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the field parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/118673/Achievo-1.4.5-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/56858; https://exchange.xforce.ibmcloud.com/vulnerabilities/80571
CVE: CVE-2014-2081
Published: 2014-10-20
Description: Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before 2013.2.4 and 2014.x before 2014.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127997/VTLS-Virtua-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Aug/64; http://packetstormsecurity.com/files/127997/VTLS-Virtua-SQL-Injection.html
CVE: CVE-2014-5094
Published: 2014-10-20
Description: Status2k allows remote attackers to obtain configuration information via a phpinfo action in a request to status/index.php, which calls the phpinfo function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/127719/Status2k-XSS-SQL-Injection-Command-Execution.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/95114; http://packetstormsecurity.com/files/127719/Status2k-XSS-SQL-Injection-Command-Execution.html
CVE: CVE-2014-5098
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in the Search module before 1.2.2 in Jamroom allows remote attackers to inject arbitrary web script or HTML via the query string to search/results/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127854/Jamroom-5.2.6-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/533120/100/0/threaded; http://www.securityfocus.com/bid/69219
CVE: CVE-2014-5447
Published: 2014-10-20
Description: Zarafa WebAccess 7.1.10 and WebApp 1.6 beta uses weak permissions (644) for config.php, which allows local users to obtain sensitive information by reading the PHP session files.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0103.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2014-0380.html; http://seclists.org/oss-sec/2014/q3/444; http://seclists.org/oss-sec/2014/q3/445
CVE: CVE-2014-5448
Published: 2014-10-20
Description: Zarafa 5.00 uses world-readable permissions for the files in the log directory, which allows local users to obtain sensitive information by reading the log files.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2014-0380.html; http://seclists.org/oss-sec/2014/q3/444; http://seclists.org/oss-sec/2014/q3/445
CVE: CVE-2014-5449
Published: 2014-10-20
Description: Zarafa WebAccess 4.1 and WebApp uses world-readable permissions for the files in their tmp directory, which allows local users to obtain sensitive information by reading temporary session data.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://advisories.mageia.org/MGASA-2014-0380.html; http://seclists.org/oss-sec/2014/q3/444; http://seclists.org/oss-sec/2014/q3/445
CVE: CVE-2014-8329
Published: 2014-10-20
Description: Schrack Technik microControl with firmware before 1.7.0 (937) stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain access data for the ftp and telnet services via a direct request for ZTPUsrDtls.txt.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2014/Jul/40; https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140710-2_Schrack_Technik_Microcontrol_Multiple_critical_vulnerabilities_v10.txt; http://seclists.org/fulldisclosure/2014/Jul/40
CVE: CVE-2012-5694
Published: 2014-10-20
Description: Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.pl; the (6) modemPhoneNo, (7) controlKey, or (8) appURLPath parameter to frameworkgui/attachMobileModem.pl; the agentsDD parameter to (9) escalatePrivileges.pl, (10) getContacts.pl, (11) getDatabase.pl, (12) sendSMS.pl, or (13) takePic.pl in frameworkgui/; or the modemNoDD parameter to (14) escalatePrivileges.pl, (15) getContacts.pl, (16) getDatabase.pl, (17) SEAttack.pl, (18) sendSMS.pl, (19) takePic.pl, or (20) CSAttack.pl in frameworkgui/.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/87324; http://osvdb.org/87325; http://secunia.com/advisories/51414
CVE: CVE-2012-5695
Published: 2014-10-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS message.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/87327; http://secunia.com/advisories/51415; https://exchange.xforce.ibmcloud.com/vulnerabilities/80313
CVE: CVE-2012-5696
Published: 2014-10-20
Description: Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: https://twitter.com/georgiaweidman/statuses/[PII_REDACTED]67855618; https://www.htbridge.com/advisory/HTB23123; https://twitter.com/georgiaweidman/statuses/[PII_REDACTED]67855618
CVE: CVE-2012-5697
Published: 2014-10-20
Description: The btinstall installation script in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 uses weak permissions (777) for all files in the frameworkgui/ directory, which allows local users to obtain sensitive information or inject arbitrary Perl code via direct access to these files.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/51415; https://twitter.com/georgiaweidman/statuses/[PII_REDACTED]67855618; https://www.htbridge.com/advisory/HTB23123
CVE: CVE-2014-3830
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in info.php in TomatoCart 1.1.8.6.1 allows remote attackers to inject arbitrary web script or HTML via the faqs_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127785/TomatoCart-1.x-Cross-Site-Scripting-SQL-Injection.html; https://breaking.technology/advisories/CVE-2014-3830.txt; http://packetstormsecurity.com/files/127785/TomatoCart-1.x-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2014-3978
Published: 2014-10-20
Description: SQL injection vulnerability in TomatoCart 1.1.8.6.1 allows remote authenticated users to execute arbitrary SQL commands via the First Name and Last Name fields in a new address book contact.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127785/TomatoCart-1.x-Cross-Site-Scripting-SQL-Injection.html; https://breaking.technology/advisories/CVE-2014-3978.txt; http://packetstormsecurity.com/files/127785/TomatoCart-1.x-Cross-Site-Scripting-SQL-Injection.html
CVE: CVE-2014-5275
Published: 2014-10-20
Description: Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) password, (2) email, or (3) id parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.html; http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.html; http://www.exploit-db.com/exploits/34275
CVE: CVE-2014-5276
Published: 2014-10-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to inject arbitrary web script or HTML via (1) an uploaded profile picture or (2) the edit parameter to profiles/index.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2014-08/0026.html; http://packetstormsecurity.com/files/127775/Pro-Chat-Rooms-8.2.0-XSS-Shell-Upload-SQL-Injection.html; http://www.exploit-db.com/exploits/34275
CVE: CVE-2014-8330
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in EspoCRM allows remote authenticated users to inject arbitrary web script or HTML via the Name field in a new account.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127827/Espo-CRM-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/127827/Espo-CRM-Cross-Site-Scripting.html
CVE: CVE-2014-8331
Published: 2014-10-20
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3236 before E3276sTCPU-V200R002B470D13SP00C00 and E3276sWebUI-V100R007B100D03SP01C03 and E3276 before E3236sTCPU-V200R002B146D41SP00C00 and E3236sWebUI-V100R007B100D03SP01C03 allow remote attackers to hijack the authentication of administrators for requests that (1) change configuration settings or (2) use device functions.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://osvdb.org/show/osvdb/109885; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-360246.htm; https://exchange.xforce.ibmcloud.com/vulnerabilities/95198
CVE: CVE-2014-3564
Published: 2014-10-20
Description: Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git%3Ba=commit%3Bh=2cbd76f7911fc215845e89b50d6af5ff4a83dd77; http://seclists.org/oss-sec/2014/q3/266; http://www.debian.org/security/2014/dsa-3005
CVE: CVE-2014-5025
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://bugs.cacti.net/view.php?id=2456; http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html; http://www.debian.org/security/2014/dsa-3007
CVE: CVE-2014-5026
Published: 2014-10-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://bugs.cacti.net/view.php?id=2456; http://lists.opensuse.org/opensuse-updates/2015-03/msg00034.html; http://seclists.org/oss-sec/2014/q3/244
CVE: CVE-2014-5169
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in the Date module before 7.x-2.8 for Drupal allows remote authenticated users with the permission to create a date field to inject arbitrary web script or HTML via the date field title.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2014/07/31/2; http://www.openwall.com/lists/oss-security/2014/07/31/4; http://www.securityfocus.com/bid/68974
CVE: CVE-2014-8363
Published: 2014-10-20
Description: SQL injection vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to execute arbitrary SQL commands via the ss_id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127771/WordPress-WPSS-0.62-SQL-Injection.html; http://www.securityfocus.com/bid/69089; http://packetstormsecurity.com/files/127771/WordPress-WPSS-0.62-SQL-Injection.html
CVE: CVE-2014-8364
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in ss_handler.php in the WordPress Spreadsheet (wpSS) plugin 0.62 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ss_id parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127770/WordPress-WPSS-0.62-Cross-Site-Scripting.html; http://www.securityfocus.com/bid/69073; http://packetstormsecurity.com/files/127770/WordPress-WPSS-0.62-Cross-Site-Scripting.html
CVE: CVE-2014-3863
Published: 2014-10-20
Description: Cross-site scripting (XSS) vulnerability in the JChatSocial component before 2.3 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the filename parameter in a file upload in an active JChat chat window.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127372/Joomla-JChatSocial-2.2-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/532662/100/0/threaded; http://www.securityfocus.com/bid/68424
CVE: CVE-2014-8365
Published: 2014-10-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xornic Contact Us allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) email parameter to contact.php or (3) PATH_INFO to setup.php, related to the "PHP_SELF" variable.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html; http://seclists.org/fulldisclosure/2014/Jun/40; http://packetstormsecurity.com/files/127003/Xornic-Contact-Us-Form-CAPTCHA-Bypass-XSS.html
CVE: CVE-2014-8366
Published: 2014-10-20
Description: SQL injection vulnerability in openSIS 4.5 through 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.com/files/127284/openSIS-5.3-SQL-Injection.html; http://seclists.org/fulldisclosure/2014/Jun/151; http://secunia.com/advisories/59114
CVE: CVE-2014-4884
Published: 2014-10-21
Description: The Conrad Hotel (aka com.wConradHotel) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/904489; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4885
Published: 2014-10-21
Description: The CPWORLD Close Protection World (aka com.tapatalk.closeprotectionworldcom) application 3.4.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/918657; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4887
Published: 2014-10-21
Description: The Joint Radio Blues (aka com.nobexinc.wls_69685189.rc) application 3.2.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/472321; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4888
Published: 2014-10-21
Description: The BattleFriends at Sea GOLD (aka com.tequilamobile.warshipslivegold) application 1.1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/806633; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4889
Published: 2014-10-21
Description: The Diabetic Diet Guide (aka com.wDiabeticDietGuide) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/771257; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4890
Published: 2014-10-21
Description: The Nano Digest (aka com.magzter.nanodigest) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/722857; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4891
Published: 2014-10-21
Description: The CT iHub (aka com.concursive.ctihub) application 1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/587953; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4892
Published: 2014-10-21
Description: The uControl Smart Home Automation (aka de.ucontrol) application 1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/200753; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4894
Published: 2014-10-21
Description: The MyMetro (aka com.myrippleapps.mymetro) application 2.4.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/540257; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4895
Published: 2014-10-21
Description: The Herpin Time Radio (aka com.herpin.time.radio) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/117329; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4896
Published: 2014-10-21
Description: The Parque Imperial (aka com.a[PII_REDACTED]20606f84b2188a.a23428594a) application 1.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/449353; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4897
Published: 2014-10-21
Description: The Touriosity Travelmag (aka com.magzter.touriositytravelmag) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/480153; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4898
Published: 2014-10-21
Description: The Harivijay (aka com.upasanhar.marathi.harivijay) application 4.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/439409; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4899
Published: 2014-10-21
Description: The Indian Cement Review (aka com.magzter.indiancementreview) application 3.01 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/876241; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4900
Published: 2014-10-21
Description: The migme (aka com.projectgoth) application 4.03.002 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/428673; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4901
Published: 2014-10-21
Description: The Bond Trading (aka com.appmakr.app613309) application 197705 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/560497; http://www.kb.cert.org/vuls/id/582497; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing
CVE: CVE-2014-4903
Published: 2014-10-21
Description: The Kakao Bingo Garden (aka com.mocoga.bingogarden) application 1.0.14 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-310
References: http://www.kb.cert.org/vuls/id/582497; http://www.kb.cert.org/vuls/id/793257; https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing