Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,968 results · page 8 of 40
Jun 16, 2017The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers toCVE-2017-9561 · Other software · Lbtc · reported by MITREMedium 5.9
The Lee Bank & Trust lbtc-mobile/id1068984753 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- LEE Bank & Trust
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spCVE-2017-9560 · Other software · Cayugalakenationalbank · reported by MITREMedium 5.9
The cayuga-lake-national-bank/id1151601539 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Cayuga Lake National Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoCVE-2017-9559 · Other software · Meafinancial · reported by MITREMedium 5.9
The MEA Financial vision-bank/id420406345 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Vision Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackCVE-2017-9558 · Other software · Wawacu · reported by MITREMedium 5.9
The wawa-employees-credit-union-mobile/id1158082793 app 4.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Wawa Employees Credit Union Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2017The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof sCVE-2016-7816 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 5.9
The Cybozu kintone mobile for Android 1.0.6 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- kintone mobile for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjvn.jp
Jun 9, 2017The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers,CVE-2016-7805 · Other software · Nihon Unisys, Ltd. · reported by vultures@jpcert.or.jpMedium 5.9
The mobiGate App for Android version 2.2.1.2 and earlier and mobiGate App for iOS version 2.2.4.1 and earlier do not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- mobiGate App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjvn.jp
Jun 8, 2017Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack vCVE-2016-5648 · Other software · Acer · reported by cret@cert.orgMedium 5.3
Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.
- Product
- Acer Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
May 15, 2017The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain seCVE-2017-8943 · Other software · Puma · reported by MITREMedium 5.9
The PUMA PUMATRAC app 3.0.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Pumatrac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows mCVE-2017-8942 · Other software · Yottamark Inc. · reported by MITREMedium 5.9
The YottaMark ShopWell - Healthy Diet & Grocery Food Scanner app 5.3.7 through 5.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Shopwell - Healthy Diet & Grocery Food Scanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof CVE-2017-8941 · Other software · Interval International · reported by MITREMedium 5.9
The Interval International app 3.3 through 3.5.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Interval International
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2017-8940 · Other software · Zipongo Inc. · reported by MITREMedium 5.9
The Zipongo - Healthy Recipes and Grocery Deals app before 6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Healthy Recipes And Grocery Deals
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers aCVE-2017-8938 · Other software · Radiojavan · reported by MITREMedium 5.9
The Radio Javan app 9.3.4 through 9.6.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Radio Javan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtaiCVE-2017-8937 · Other software · Life Before US · reported by MITREMedium 5.9
The Life Before Us Yo app 2.5.8 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Yo.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which alloCVE-2017-8936 · Other software · Changyou · reported by MITREMedium 5.9
The MoboTap Dolphin Web Browser - Fast Private Internet Search app 9.23.0 through 9.23.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Dolphin Web Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2017The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers toCVE-2017-8935 · Other software · Gocivix · reported by MITREMedium 5.9
The Quest Information Systems Indiana Voters app 1.1.24 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Indiana Voters
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silCVE-2017-8060 · Network & remote access · Watchguard · reported by MITREMedium 5.9
Acceptance of invalid/self-signed TLS certificates in "Panda Mobile Security" 1.1 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.
- Product
- Panda Mobile Security
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commedium.com
May 5, 2017Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or phyCVE-2017-8059 · Other software · Foxitsoftware · reported by MITREHigh 8.1
Acceptance of invalid/self-signed TLS certificates in "Foxit PDF - PDF reader, editor, form, signature" before 5.4 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept login information (username/password), in addition to the static authentication token if the user is already logged in.
- Product
- Foxit PDF
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker toCVE-2017-8058 · Websites & servers · Atlassian · reported by MITREMedium 5.9
Acceptance of invalid/self-signed TLS certificates in Atlassian HipChat before 3.16.2 for iOS allows a man-in-the-middle and/or physically proximate attacker to silently intercept information sent during the login API call.
- Product
- Hipchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.commedium.com
May 5, 2017The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers andCVE-2017-5919 · Other software · 21st Century Insurance · reported by MITREMedium 5.9
The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- 21st Century Insurance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof serversCVE-2017-5918 · Other software · Banco DE Costa Rica · reported by MITREMedium 5.9
The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- BCR Movil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-midCVE-2017-5916 · Other software · America's First Federal Credit Union · reported by MITREMedium 5.9
The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- America's First FCU Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSLCVE-2017-5915 · Other software · Emirates NBD Bank P.j.s.c · reported by MITREMedium 5.9
The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Emirates NBD
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtCVE-2017-5914 · Other software · Dotit-corp · reported by MITREMedium 5.9
The DOT IT Banque Zitouna app 2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Banque Zitouna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers CVE-2017-5913 · Other software · Forex · reported by MITREMedium 5.9
The TradeKing Forex for iPhone app 1.2.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Tradeking Forex
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2017-5912 · Other software · Forex · reported by MITREMedium 5.9
The FOREX.com FOREXTrader for iPhone app 2.9.12 through 2.9.14 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Forextrader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackeCVE-2017-5911 · Other software · Banco Santander Mexico SA · reported by MITREMedium 5.9
The Banco Santander Mexico SA Supermovil app 3.5 through 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Supermovil
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attacCVE-2017-5909 · Other software · Electronic Funds Source LLC · reported by MITREMedium 5.9
The Electronic Funds Source (EFS) Mobile Driver Source app 2.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- EFS Mobile Driver Source
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middCVE-2017-5907 · Other software · Great Southern Bank · reported by MITREMedium 5.9
The Great Southern Bank Great Southern Mobile Banking app before 4.0.4 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Great Southern Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-tCVE-2017-5906 · Other software · Everyday Health INC · reported by MITREMedium 5.9
The Everyday Health Diabetes in Check: Blood Glucose & Carb Tracker app 3.4.2 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Diabetes IN Check\
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtaCVE-2017-5905 · Other software · Dollar Bank · reported by MITREMedium 5.9
The Dollar Bank Mobile app 2.6.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Dollar Bank Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiCVE-2017-5902 · Other software · Payquicker · reported by MITREMedium 5.9
The PayQuicker app 1.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Mypayquicker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sCVE-2017-5901 · Other software · State Bank Of India · reported by MITREMedium 5.9
The State Bank of India State Bank Anywhere app 5.1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- State Bank Anywhere
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2017The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof seCVE-2017-3213 · Other software · Think Mutual Bank · reported by cret@cert.orgMedium 5.9
The Think Mutual Bank Mobile Banking app 3.1.5 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Think Mutual Bank Mobile Banking App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
May 5, 2017The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middCVE-2017-3212 · Other software · Sccu · reported by cret@cert.orgMedium 5.9
The Space Coast Credit Union Mobile app 2.2 for iOS and 2.1.0.1104 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Space Coast Credit Union
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgsecurityfocus.com
Apr 28, 2017The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle atCVE-2017-2110 · Other software · NISSAN SECURITIES CO., LTD. · reported by vultures@jpcert.or.jpMedium 5.9
The Access CX App for Android prior to 2.0.0.1 and for iOS prior to 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Access CX App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obCVE-2017-2105 · Other software · PRESENTCAST INC. · reported by vultures@jpcert.or.jpMedium 5.9
The TVer App for Android 3.2.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- TVer App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof CVE-2017-2104 · Other software · K-Opticom Corporation · reported by vultures@jpcert.or.jpMedium 5.9
The Business LaLa Call App for Android 1.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Business LaLa Call App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers aCVE-2017-2103 · Other software · K-Opticom Corporation · reported by vultures@jpcert.or.jpMedium 5.9
The LaLa Call App for Android 2.4.7 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- LaLa Call App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 28, 2017Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network.CVE-2016-7815 · Other software · Cybozu, Inc. · reported by vultures@jpcert.or.jpMedium 4.2
Remote Service Manager 3.0.0 to 3.1.4 fails to verify client certificates, which may allow remote attackers to gain access to systems on the network.
- Product
- Remote Service Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 21, 2017The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-tCVE-2016-1519 · Other software · Grandstream · reported by cret@cert.orgMedium 5.9
The com.softphone.common package in the Grandstream Wave app 1.0.1.26 and earlier for Android does not properly validate SSL certificates, which allows man-in-the-middle attackers to spoof the Grandstream provisioning server via a crafted certificate.
- Product
- Wave
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Apr 21, 2017Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensiCVE-2016-1221 · Other software · Jetstar · reported by vultures@jpcert.or.jpMedium 5.9
Jetstar App for iOS before 3.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Jetstar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof CVE-2016-1210 · Other software · The Hyakugo Bank · reported by vultures@jpcert.or.jpMedium 5.9
The 105 BANK app 1.0 and 1.1 for Android and 1.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- 105 Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Photopt for Android before 2.0.1 does not verify SSL certificates.CVE-2016-1198 · Other software · NTT · reported by vultures@jpcert.or.jpMedium 5.9
Photopt for Android before 2.0.1 does not verify SSL certificates.
- Product
- Photopt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.CVE-2016-1187 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 6.8
Cybozu KUNAI for iPhone 2.0.3 through 3.1.5 and for Android 2.1.2 through 3.0.4 does not verify SSL certificates.
- Product
- Kunai
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.CVE-2016-1186 · Other software · Cybozu · reported by vultures@jpcert.or.jpMedium 5.9
Kintone mobile for Android 1.0.0 through 1.0.5 does not verify SSL server certificates.
- Product
- Kintone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates.CVE-2016-4840 · Other software · Toshiba · reported by vultures@jpcert.or.jpMedium 5.9
Coordinate Plus App for Android 1.0.2 and earlier and Coordinate Plus App for iOS 1.0.2 and earlier do not verify SSL certificates.
- Product
- Coordinate Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.CVE-2016-4832 · Other software · Aeon · reported by vultures@jpcert.or.jpMedium 5.9
WAON "Service Application" for Android 1.4.1 and earlier does not verify SSL certificates.
- Product
- Waon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.CVE-2016-4830 · Other software · Akindo-sushiro · reported by vultures@jpcert.or.jpMedium 5.9
Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
- Product
- Sushiro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.CVE-2016-4829 · Other software · DMM · reported by vultures@jpcert.or.jpMedium 5.9
DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.
- Product
- PPV Play Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2017Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.CVE-2016-1184 · Other software · Tokyostarbank · reported by vultures@jpcert.or.jpMedium 5.9
Tokyo Star bank App for Android before 1.4 and Tokyo Star bank App for iOS before 1.4 do not validate SSL certificates.
- Product
- Tokyo Star Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.