Search
Find a vulnerability
Search criteria
18 vulnerabilities by appsgeyser
VAR-201410-0285
Vulnerability from variot - Updated: 2025-04-13 22:36The My nTelos (aka com.telespree.ntelospostpay) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: nTelos Wireless has indicated that this vulnerability report is incorrect. ** Unsettled ** This case has not been confirmed as a vulnerability. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 1.1.2 of the Android My nTelos application
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201410-0285",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "my ntelos",
"scope": "eq",
"trust": 1.6,
"vendor": "nteloswireless",
"version": "1.1.2"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "my ntelos",
"scope": "eq",
"trust": 0.8,
"vendor": "ntelos",
"version": "1.1.2"
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-560"
},
{
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:nteloswireless:my_ntelos",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-7042",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-7042",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-74986",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-7042",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-7042",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201410-560",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-74986",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74986"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-560"
},
{
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The My nTelos (aka com.telespree.ntelospostpay) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: nTelos Wireless has indicated that this vulnerability report is incorrect. ** Unsettled ** This case has not been confirmed as a vulnerability. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 1.1.2 of the Android My nTelos application",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-7042"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-74986"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-7042",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#898593",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201410-560",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-74986",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74986"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-560"
},
{
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"id": "VAR-201410-0285",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-74986"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T22:36:12.976000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74986"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/898593"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "https://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-7042"
},
{
"trust": 0.8,
"url": "https://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-7042"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74986"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-560"
},
{
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74986"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-560"
},
{
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-74986"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2019-07-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201410-560"
},
{
"date": "2014-10-16T19:55:12.817000",
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-11-14T00:00:00",
"db": "VULHUB",
"id": "VHN-74986"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2019-07-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-008671"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201410-560"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-7042"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-0166
Vulnerability from variot - Updated: 2025-04-13 22:06The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 4.1.1 of the Android DS file application
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0166",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ds file",
"scope": "eq",
"trust": 2.4,
"vendor": "synology",
"version": "4.1.1"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1187"
},
{
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-6848",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-6848",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-74792",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-6848",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-6848",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-1187",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-74792",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74792"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1187"
},
{
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 4.1.1 of the Android DS file application",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-6848"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-74792"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-6848",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#954825",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1187",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-74792",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74792"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1187"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"id": "VAR-201409-0166",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-74792"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T22:06:28.913000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "com.synology.DSfile",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.synology.DSfile"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74792"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/954825"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6848"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-6848"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74792"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1187"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74792"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1187"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-30T00:00:00",
"db": "VULHUB",
"id": "VHN-74792"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-1187"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-30T17:55:03.263000",
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-11-14T00:00:00",
"db": "VULHUB",
"id": "VHN-74792"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006542"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-10-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-1187"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-6848"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201409-1187"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201409-1187"
}
],
"trust": 0.6
}
}
VAR-201410-0140
Vulnerability from variot - Updated: 2025-04-13 22:02The DS audio (aka com.synology.DSaudio) application 3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 3.4 of the Android DS audio application
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201410-0140",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ds audio",
"scope": "eq",
"trust": 2.4,
"vendor": "synology",
"version": "3.4"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-022"
},
{
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-6868",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-6868",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-74812",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-6868",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-6868",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201410-022",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-74812",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74812"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-022"
},
{
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The DS audio (aka com.synology.DSaudio) application 3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 3.4 of the Android DS audio application",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-6868"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-74812"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-6868",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#981313",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201410-022",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-74812",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74812"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-022"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"id": "VAR-201410-0140",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-74812"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T22:02:20.808000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "com.synology.DSaudio",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.synology.DSaudio"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74812"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/981313"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6868"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-6868"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74812"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-022"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74812"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-022"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-10-02T00:00:00",
"db": "VULHUB",
"id": "VHN-74812"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201410-022"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-10-02T10:55:06.343000",
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-11-14T00:00:00",
"db": "VULHUB",
"id": "VHN-74812"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006561"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-10-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201410-022"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-6868"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201410-022"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201410-022"
}
],
"trust": 0.6
}
}
VAR-201409-0871
Vulnerability from variot - Updated: 2025-04-13 20:21The Cartoon Camera (aka com.fingersoft.cartooncamera) application 1.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in the version 1.2.2 of the Android Cartoon Camera application
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0871",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cartoon camera",
"scope": "eq",
"trust": 2.4,
"vendor": "fingersoft",
"version": "1.2.2"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-151"
},
{
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-5618",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-5618",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-73560",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-5618",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "NVD",
"id": "CVE-2014-5618",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-151",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-73560",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73560"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-151"
},
{
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Cartoon Camera (aka com.fingersoft.cartooncamera) application 1.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in the version 1.2.2 of the Android Cartoon Camera application",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5618"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-73560"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-5618",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#164409",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201409-151",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-73560",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73560"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-151"
},
{
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"id": "VAR-201409-0871",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-73560"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T20:21:03.986000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "Android apps that fail to validate SSL",
"trust": 0.8,
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
},
{
"title": "\u30ab\u30fc\u30c8\u30a5\u30fc\u30f3\u30ab\u30e1\u30e9 (Cartoon Camera)",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.fingersoft.cartooncamera"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73560"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/164409"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5618"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5618"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73560"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-151"
},
{
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73560"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-151"
},
{
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-73560"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-09-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-151"
},
{
"date": "2014-09-09T01:55:31.150000",
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-11T00:00:00",
"db": "VULHUB",
"id": "VHN-73560"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-09-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004452"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-151"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-5618"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-0154
Vulnerability from variot - Updated: 2025-04-13 20:14The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 3.3 of the Android DS photo+ application
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0154",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ds photo\\+",
"scope": "eq",
"trust": 1.6,
"vendor": "synology",
"version": "3.3"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "ds photo+",
"scope": "eq",
"trust": 0.8,
"vendor": "synology",
"version": "3.3"
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1140"
},
{
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:synology:ds_photo%2b",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-6836",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-6836",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-74780",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-6836",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-6836",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-1140",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-74780",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74780"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1140"
},
{
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 3.3 of the Android DS photo+ application",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-6836"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-74780"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-6836",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#847817",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1140",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-74780",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74780"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1140"
},
{
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"id": "VAR-201409-0154",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-74780"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T20:14:26.322000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "com.synology.dsphoto",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.synology.dsphoto"
},
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-74780"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/847817"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6836"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-6836"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74780"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1140"
},
{
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-74780"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-1140"
},
{
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-30T00:00:00",
"db": "VULHUB",
"id": "VHN-74780"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-1140"
},
{
"date": "2014-09-30T10:55:06.270000",
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-11-14T00:00:00",
"db": "VULHUB",
"id": "VHN-74780"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006530"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-10-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-1140"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-6836"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-0993
Vulnerability from variot - Updated: 2025-04-13 20:13The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Cisco Technical Support (also known as com.cisco.swtg_android) application for Android is a set of technical support applications based on the Android platform of Cisco (Cisco). There is a security vulnerability in the Android Cisco Technical Support application version 3.7.1
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0993",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "technical support",
"scope": "eq",
"trust": 2.4,
"vendor": "cisco",
"version": "3.7.1"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-476"
},
{
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-5868",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-5868",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-73810",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-5868",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-5868",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-476",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-73810",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73810"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-476"
},
{
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Cisco Technical Support (also known as com.cisco.swtg_android) application for Android is a set of technical support applications based on the Android platform of Cisco (Cisco). There is a security vulnerability in the Android Cisco Technical Support application version 3.7.1",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5868"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-73810"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-5868",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#698569",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-476",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-73810",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73810"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-476"
},
{
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"id": "VAR-201409-0993",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-73810"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T20:13:47.599000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "com.cisco.swtg_android",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.cisco.swtg_android"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73810"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/698569"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5868"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5868"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73810"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-476"
},
{
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73810"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-476"
},
{
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-11T00:00:00",
"db": "VULHUB",
"id": "VHN-73810"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-476"
},
{
"date": "2014-09-11T10:55:02.550000",
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-21T00:00:00",
"db": "VULHUB",
"id": "VHN-73810"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006182"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-476"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-5868"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-0981
Vulnerability from variot - Updated: 2025-04-13 20:12The Selfie Camera -Facial Beauty- (aka com.cfinc.cunpic) application 1.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Selfie Camera -Facial Beauty- (also known as com.cfinc.cunpic) application for Android is a set of applications based on the Android platform
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0981",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "selfie camera -facial beauty-",
"scope": "eq",
"trust": 2.4,
"vendor": "communityfactory",
"version": "1.2.7"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-387"
},
{
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-5856",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-5856",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-73798",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-5856",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-5856",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-387",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-73798",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73798"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-387"
},
{
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Selfie Camera -Facial Beauty- (aka com.cfinc.cunpic) application 1.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Selfie Camera -Facial Beauty- (also known as com.cfinc.cunpic) application for Android is a set of applications based on the Android platform",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5856"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-73798"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-5856",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#579065",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-387",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-73798",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73798"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-387"
},
{
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"id": "VAR-201409-0981",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-73798"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T20:12:18.916000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "com.cfinc.cunpic",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.cfinc.cunpic"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73798"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/579065"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5856"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5856"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73798"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-387"
},
{
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73798"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-387"
},
{
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-73798"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-387"
},
{
"date": "2014-09-09T10:55:16.897000",
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-21T00:00:00",
"db": "VULHUB",
"id": "VHN-73798"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006170"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-387"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-5856"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-0791
Vulnerability from variot - Updated: 2025-04-13 19:59The verizon (aka com.wverizonwirelessbill) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0791",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "verizon",
"scope": "eq",
"trust": 2.4,
"vendor": "gunhillwireless",
"version": "0.1"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-289"
},
{
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-5755",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-5755",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-73697",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-5755",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-5755",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-289",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-73697",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73697"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-289"
},
{
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The verizon (aka com.wverizonwirelessbill) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5755"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-73697"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-5755",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#820537",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-289",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-73697",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73697"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-289"
},
{
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"id": "VAR-201409-0791",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-73697"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T19:59:11.860000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "com.wverizonwirelessbill",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.wverizonwirelessbill"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73697"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/820537"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5755"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5755"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73697"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-289"
},
{
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73697"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-289"
},
{
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-73697"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-289"
},
{
"date": "2014-09-09T10:55:11.207000",
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-16T00:00:00",
"db": "VULHUB",
"id": "VHN-73697"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006072"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2015-12-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-289"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-5755"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201410-0592
Vulnerability from variot - Updated: 2025-04-13 19:51The Mitsubishi Road Assist (aka com.agero.mitsubishi) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201410-0592",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mitsubishi road assist",
"scope": "eq",
"trust": 1.6,
"vendor": "mitsubishicars",
"version": "1"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "mitsubishi road assist",
"scope": "eq",
"trust": 0.8,
"vendor": "mitsubishicars",
"version": "1.0"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "road assist mitsubishi road assist application for android",
"scope": "eq",
"trust": 0.6,
"vendor": "mitsubishi",
"version": "1.0"
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "mitsubishi road assist",
"version": "1"
}
],
"sources": [
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-871"
},
{
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-7486",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-7486",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CNVD-2014-07783",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-7486",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-7486",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-07783",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201410-871",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-871"
},
{
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Mitsubishi Road Assist (aka com.agero.mitsubishi) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-7486"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
}
],
"trust": 6.03
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.9
},
{
"db": "NVD",
"id": "CVE-2014-7486",
"trust": 3.2
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "CERT/CC",
"id": "VU#345425",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2014-07783",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201410-871",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "IVD",
"id": "C19B48D0-2351-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-871"
},
{
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"id": "VAR-201410-0592",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
}
]
},
"last_update_date": "2025-04-13T19:51:21.816000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "com.agero.mitsubishi",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.agero.mitsubishi"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.8
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 4.0,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.6,
"url": "http://www.kb.cert.org/vuls/id/345425"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-7486"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-7486"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-871"
},
{
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201410-871"
},
{
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-11-03T00:00:00",
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-11-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201410-871"
},
{
"date": "2014-10-20T10:55:07.920000",
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-11-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-07783"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006952"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201410-871"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-7486"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Mitsubishi Road Assist application for Android Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "c19b48d0-2351-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-07783"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-0273
Vulnerability from variot - Updated: 2025-04-13 19:47The Vendormate Mobile (aka com.vendormate.mobile) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. Vendormate Mobile for Android SSL is an Android platform based application. Vendormate Mobile for Android SSL has a security vulnerability. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-0273",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mobile",
"scope": "eq",
"trust": 2.4,
"vendor": "vendormate",
"version": "3.0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "mobile for android",
"scope": "eq",
"trust": 0.6,
"vendor": "vendormate",
"version": "3.0"
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "vendormate mobile",
"version": "3.0"
}
],
"sources": [
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-902"
},
{
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-6701",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-6701",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CNVD-2014-06497",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-6701",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-6701",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-06497",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-902",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-902"
},
{
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Vendormate Mobile (aka com.vendormate.mobile) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. Vendormate Mobile for Android SSL is an Android platform based application. Vendormate Mobile for Android SSL has a security vulnerability. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-6701"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
}
],
"trust": 6.03
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.3
},
{
"db": "NVD",
"id": "CVE-2014-6701",
"trust": 3.2
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "CERT/CC",
"id": "VU#234369",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2014-06497",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-902",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "OSVDB",
"id": "112223",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "IVD",
"id": "49C93878-1EB8-11E6-ABEF-000C29C66E3D",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-902"
},
{
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"id": "VAR-201409-0273",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
}
],
"trust": 1.8
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
}
]
},
"last_update_date": "2025-04-13T19:47:50.811000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "com.vendormate.mobile",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.vendormate.mobile"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.8
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.0,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.5,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.6,
"url": "http://www.kb.cert.org/vuls/id/234369"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-6701"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6701"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://osvdb.com/show/osvdb/112223"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-902"
},
{
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-902"
},
{
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-10-08T00:00:00",
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-902"
},
{
"date": "2014-09-24T01:55:13.470000",
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-10-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-06497"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006397"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-902"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-6701"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Vendormate Mobile for Android SSL Information Disclosure Vulnerability",
"sources": [
{
"db": "IVD",
"id": "49c93878-1eb8-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2014-06497"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-1041
Vulnerability from variot - Updated: 2025-04-13 19:44The Selfshot - Front Flash Camera (aka com.americos.selfshot) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Selfshot - Front Flash Camera (also known as com.americos.selfshot) application for Android is a mobile phone front camera camera application based on the Android platform. There is a security vulnerability in Android Selfshot - Front Flash Camera application version 1.1
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-1041",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "selfshot front flash camera",
"scope": "eq",
"trust": 1.6,
"vendor": "americostech",
"version": "1.1"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "selfshot - front flash camera",
"scope": "eq",
"trust": 0.8,
"vendor": "americos pvt",
"version": "1.1"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-100"
},
{
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:besttoolbars:appsgeyser",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-5566",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-5566",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-73508",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-5566",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-5566",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-100",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-73508",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73508"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-100"
},
{
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Selfshot - Front Flash Camera (aka com.americos.selfshot) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Selfshot - Front Flash Camera (also known as com.americos.selfshot) application for Android is a mobile phone front camera camera application based on the Android platform. There is a security vulnerability in Android Selfshot - Front Flash Camera application version 1.1",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5566"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-73508"
}
],
"trust": 5.4
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-5566",
"trust": 2.5
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#805753",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-100",
"trust": 0.7
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-73508",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73508"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-100"
},
{
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"id": "VAR-201409-1041",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-73508"
}
],
"trust": 0.01
},
"last_update_date": "2025-04-13T19:44:02.751000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "Android apps that fail to validate SSL",
"trust": 0.8,
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
},
{
"title": "Selfshot - Front Flash Camera",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.americos.selfshot"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73508"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/805753"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5566"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5566"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73508"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-100"
},
{
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "VULHUB",
"id": "VHN-73508"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-100"
},
{
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-73508"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-100"
},
{
"date": "2014-09-09T01:55:15.867000",
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-73508"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004237"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-100"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-5566"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.6
}
}
VAR-201409-1059
Vulnerability from variot - Updated: 2025-04-12 22:32The Cisco Class Locator Fast Lane (aka com.tabletkings.mycompany.fastlane.cisco) application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. Cisco is a network solution provider. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201409-1059",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cisco class locator fast lane",
"scope": "eq",
"trust": 1.6,
"vendor": "flane",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "appsgeyser",
"version": null
},
{
"model": "cisco class locator fast lane",
"scope": null,
"trust": 0.8,
"vendor": "fast lane institute for knowledge transfer",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.8,
"vendor": "besttoolbars",
"version": "created with android application"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "class locator fast lane",
"scope": null,
"trust": 0.6,
"vendor": "cisco",
"version": null
},
{
"model": "appsgeyser",
"scope": "eq",
"trust": 0.3,
"vendor": "appsgeyser",
"version": "0"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-244"
},
{
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:flane:cisco_class_locator_fast_lane",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Will Dormann of the CERT/CC",
"sources": [
{
"db": "BID",
"id": "71760"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
}
],
"trust": 0.9
},
"cve": "CVE-2014-5710",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "CVE-2014-5710",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:A/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "IPA",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "JVNDB-2014-004043",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2014-05844",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 5.5,
"id": "VHN-73652",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:A/AC:M/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-5710",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2014-5710",
"trust": 0.8,
"value": "Medium"
},
{
"author": "IPA",
"id": "JVNDB-2014-004043",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-05844",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201409-244",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-73652",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "VULHUB",
"id": "VHN-73652"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-244"
},
{
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Cisco Class Locator Fast Lane (aka com.tabletkings.mycompany.fastlane.cisco) application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. Cisco is a network solution provider. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-5710"
},
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "VULHUB",
"id": "VHN-73652"
}
],
"trust": 5.94
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#582497",
"trust": 4.4
},
{
"db": "NVD",
"id": "CVE-2014-5710",
"trust": 3.1
},
{
"db": "CERT/CC",
"id": "VU#1680209",
"trust": 1.9
},
{
"db": "CERT/CC",
"id": "VU#319993",
"trust": 1.7
},
{
"db": "JVN",
"id": "JVNVU90369988",
"trust": 1.6
},
{
"db": "BID",
"id": "71760",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028",
"trust": 0.8
},
{
"db": "JVN",
"id": "JVNVU95399358",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201409-244",
"trust": 0.7
},
{
"db": "OSVDB",
"id": "111081",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2014-05844",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-73652",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "VULHUB",
"id": "VHN-73652"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-244"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"id": "VAR-201409-1059",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "VULHUB",
"id": "VHN-73652"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05844"
}
]
},
"last_update_date": "2025-04-12T22:32:11.175000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "com.tabletkings.mycompany.fastlane.cisco",
"trust": 0.8,
"url": "https://play.google.com/store/apps/details?id=com.tabletkings.mycompany.fastlane.cisco"
},
{
"title": "Security with HTTPS and SSL",
"trust": 0.8,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"title": "AppsGeyser",
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"title": "Cisco Class Locator Fast Lane for Android Certificate Verification Bypass Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/49932"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-310",
"trust": 1.9
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-73652"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.1,
"url": "https://docs.google.com/spreadsheets/d/1t5gxwjw82syunalvjb2w0zi3folrikfgpc7amjrf0r4/edit?usp=sharing"
},
{
"trust": 3.6,
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"trust": 1.7,
"url": "http://www.kb.cert.org/vuls/id/319993"
},
{
"trust": 1.6,
"url": "http://www.fireeye.com/blog/technical/2014/08/ssl-vulnerabilities-who-listens-when-android-applications-talk.html"
},
{
"trust": 1.6,
"url": "http://developer.android.com/training/articles/security-ssl.html"
},
{
"trust": 1.6,
"url": "http://www.ftc.gov/news-events/press-releases/2014/03/fandango-credit-karma-settle-ftc-charges-they-deceived-consumers"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p49.pdf"
},
{
"trust": 1.6,
"url": "http://android-ssl.org/files/p50-fahl.pdf"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/295.html"
},
{
"trust": 1.6,
"url": "http://cwe.mitre.org/data/definitions/296.html"
},
{
"trust": 1.6,
"url": "http://jvn.jp/vu/jvnvu90369988/index.html"
},
{
"trust": 1.4,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5710"
},
{
"trust": 1.1,
"url": "http://www.kb.cert.org/vuls/id/1680209"
},
{
"trust": 0.8,
"url": "http://www.appsgeyser.com/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5710"
},
{
"trust": 0.8,
"url": "http://jvn.jp/vu/jvnvu95399358/index.html"
},
{
"trust": 0.8,
"url": "https://www.securecoding.cert.org/confluence/pages/viewpage.action;jsessionid=38139e999b01085a7ae8552ac02eac05?pageid=134807561"
},
{
"trust": 0.8,
"url": "https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm"
},
{
"trust": 0.8,
"url": "https://www.cert.org/blogs/certcc/post.cfm?entryid=204"
},
{
"trust": 0.8,
"url": "http://www.ipa.go.jp/about/press/20140919_1.html"
},
{
"trust": 0.6,
"url": "http://www.osvdb.com/show/osvdb/111081"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/71760"
},
{
"trust": 0.3,
"url": "http://www.appsgeyser.com"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "VULHUB",
"id": "VHN-73652"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-244"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"db": "CERT/CC",
"id": "VU#582497"
},
{
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"db": "VULHUB",
"id": "VHN-73652"
},
{
"db": "BID",
"id": "71760"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"db": "CNNVD",
"id": "CNNVD-201409-244"
},
{
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-12-19T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2014-09-03T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"date": "2014-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-73652"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-244"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2014-09-09T10:55:08.787000",
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2015-01-07T00:00:00",
"db": "CERT/CC",
"id": "VU#1680209"
},
{
"date": "2016-11-08T00:00:00",
"db": "CERT/CC",
"id": "VU#582497"
},
{
"date": "2014-09-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-05844"
},
{
"date": "2014-09-12T00:00:00",
"db": "VULHUB",
"id": "VHN-73652"
},
{
"date": "2014-12-19T00:00:00",
"db": "BID",
"id": "71760"
},
{
"date": "2014-12-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-006028"
},
{
"date": "2014-12-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-007349"
},
{
"date": "2014-09-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-004043"
},
{
"date": "2014-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201409-244"
},
{
"date": "2014-12-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201412-505"
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2014-5710"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201409-244"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "AppsGeyser generates Android applications that fail to properly validate SSL certificates",
"sources": [
{
"db": "CERT/CC",
"id": "VU#1680209"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "encryption problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201409-244"
}
],
"trust": 0.6
}
}
CVE-2014-7791 (GCVE-0-2014-7791)
Vulnerability from nvd – Published: 2014-10-21 10:00 – Updated: 2024-08-06 13:03
VLAI
EPSS
VEX
Summary
The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.kb.cert.org/vuls/id/538937 | third-party-advisoryx_refsource_CERT-VN |
| http://www.kb.cert.org/vuls/id/582497 | third-party-advisoryx_refsource_CERT-VN |
| https://docs.google.com/spreadsheets/d/1t5GXwjw82… | x_refsource_MISC |
Date Public
2014-10-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:03:26.193Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#538937",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/538937"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-21T07:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#538937",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/538937"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-7791",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#538937",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/538937"
},
{
"name": "VU#582497",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"name": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
"refsource": "MISC",
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-7791",
"datePublished": "2014-10-21T10:00:00.000Z",
"dateReserved": "2014-10-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:03:26.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7089 (GCVE-0-2014-7089)
Vulnerability from nvd – Published: 2014-10-19 01:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
The COMPETITION INFORMATION (aka com.ear.bilgiyarismasi) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.kb.cert.org/vuls/id/462289 | third-party-advisoryx_refsource_CERT-VN |
| http://www.kb.cert.org/vuls/id/582497 | third-party-advisoryx_refsource_CERT-VN |
| https://docs.google.com/spreadsheets/d/1t5GXwjw82… | x_refsource_MISC |
Date Public
2014-10-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:18.951Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#462289",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/462289"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The COMPETITION INFORMATION (aka com.ear.bilgiyarismasi) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-19T01:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#462289",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/462289"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-7089",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The COMPETITION INFORMATION (aka com.ear.bilgiyarismasi) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#462289",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/462289"
},
{
"name": "VU#582497",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"name": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
"refsource": "MISC",
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-7089",
"datePublished": "2014-10-19T01:00:00.000Z",
"dateReserved": "2014-09-19T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:18.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7067 (GCVE-0-2014-7067)
Vulnerability from nvd – Published: 2014-10-19 01:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
The BTD5 Videos (aka com.wxTYILIEIRBTD5Videos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.kb.cert.org/vuls/id/959489 | third-party-advisoryx_refsource_CERT-VN |
| http://www.kb.cert.org/vuls/id/582497 | third-party-advisoryx_refsource_CERT-VN |
| https://docs.google.com/spreadsheets/d/1t5GXwjw82… | x_refsource_MISC |
Date Public
2014-10-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:18.432Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#959489",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/959489"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The BTD5 Videos (aka com.wxTYILIEIRBTD5Videos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-19T01:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#959489",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/959489"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-7067",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The BTD5 Videos (aka com.wxTYILIEIRBTD5Videos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#959489",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/959489"
},
{
"name": "VU#582497",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"name": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
"refsource": "MISC",
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-7067",
"datePublished": "2014-10-19T01:00:00.000Z",
"dateReserved": "2014-09-19T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:18.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7791 (GCVE-0-2014-7791)
Vulnerability from cvelistv5 – Published: 2014-10-21 10:00 – Updated: 2024-08-06 13:03
VLAI
EPSS
VEX
Summary
The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.kb.cert.org/vuls/id/538937 | third-party-advisoryx_refsource_CERT-VN |
| http://www.kb.cert.org/vuls/id/582497 | third-party-advisoryx_refsource_CERT-VN |
| https://docs.google.com/spreadsheets/d/1t5GXwjw82… | x_refsource_MISC |
Date Public
2014-10-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:03:26.193Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#538937",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/538937"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-21T07:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#538937",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/538937"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-7791",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Backyard Wrestling (aka com.wBackyardWrestling) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#538937",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/538937"
},
{
"name": "VU#582497",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"name": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
"refsource": "MISC",
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-7791",
"datePublished": "2014-10-21T10:00:00.000Z",
"dateReserved": "2014-10-03T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:03:26.193Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7067 (GCVE-0-2014-7067)
Vulnerability from cvelistv5 – Published: 2014-10-19 01:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
The BTD5 Videos (aka com.wxTYILIEIRBTD5Videos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.kb.cert.org/vuls/id/959489 | third-party-advisoryx_refsource_CERT-VN |
| http://www.kb.cert.org/vuls/id/582497 | third-party-advisoryx_refsource_CERT-VN |
| https://docs.google.com/spreadsheets/d/1t5GXwjw82… | x_refsource_MISC |
Date Public
2014-10-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:18.432Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#959489",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/959489"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The BTD5 Videos (aka com.wxTYILIEIRBTD5Videos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-19T01:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#959489",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/959489"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-7067",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The BTD5 Videos (aka com.wxTYILIEIRBTD5Videos) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#959489",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/959489"
},
{
"name": "VU#582497",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"name": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
"refsource": "MISC",
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-7067",
"datePublished": "2014-10-19T01:00:00.000Z",
"dateReserved": "2014-09-19T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:18.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-7089 (GCVE-0-2014-7089)
Vulnerability from cvelistv5 – Published: 2014-10-19 01:00 – Updated: 2024-08-06 12:40
VLAI
EPSS
VEX
Summary
The COMPETITION INFORMATION (aka com.ear.bilgiyarismasi) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.kb.cert.org/vuls/id/462289 | third-party-advisoryx_refsource_CERT-VN |
| http://www.kb.cert.org/vuls/id/582497 | third-party-advisoryx_refsource_CERT-VN |
| https://docs.google.com/spreadsheets/d/1t5GXwjw82… | x_refsource_MISC |
Date Public
2014-10-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T12:40:18.951Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "VU#462289",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/462289"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-10-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The COMPETITION INFORMATION (aka com.ear.bilgiyarismasi) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-10-19T01:57:01.000Z",
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc"
},
"references": [
{
"name": "VU#462289",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/462289"
},
{
"name": "VU#582497",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2014-7089",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The COMPETITION INFORMATION (aka com.ear.bilgiyarismasi) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "VU#462289",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/462289"
},
{
"name": "VU#582497",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/582497"
},
{
"name": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing",
"refsource": "MISC",
"url": "https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"assignerShortName": "certcc",
"cveId": "CVE-2014-7089",
"datePublished": "2014-10-19T01:00:00.000Z",
"dateReserved": "2014-09-19T00:00:00.000Z",
"dateUpdated": "2024-08-06T12:40:18.951Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}