CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  What's the CVSS score of your company?
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities Published In October 2014

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
801 CVE-2014-6884 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Ford Credit Account Manager (aka com.fordcredit.accountmanager) application 1.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
802 CVE-2014-6883 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The CNNMoney Portfolio for stocks (aka com.cnn.portfolio) application 1.0.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
803 CVE-2014-6882 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Western Federal Credit Union (aka com.kerrata.pulse.western) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
804 CVE-2014-6881 310 +Info 2014-10-02 2014-10-16
5.4
None Local Network Medium Not required Partial Partial Partial
The PNC Virtual Wallet (aka com.pnc.ecommerce.mobile.vw.android) application before 2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
805 CVE-2014-6880 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The TradeHero (aka com.tradehero.th) application 2.2.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
806 CVE-2014-6879 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Equifax Mobile (aka com.equifax) application 1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
807 CVE-2014-6878 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The RBFCU Mobile (aka com.Vertifi.DeposZip.P314089681) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
808 CVE-2014-6877 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Santander Personal Banking (aka com.sovereign.santander) application 2.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
809 CVE-2014-6876 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The American Express Serve (aka com.serve.mobile) application @7F0901E4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
810 CVE-2014-6875 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Woodforest Mobile Banking (aka com.woodforest) application 3.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
811 CVE-2014-6874 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The ModSim Connected (aka com.concursive.modsim) application 2.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
812 CVE-2014-6873 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The AMGC (aka com.amec.uae) application 6.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
813 CVE-2014-6872 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The TTNET Muzik (aka com.ttnet.muzik) application 3.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
814 CVE-2014-6871 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Hogs Fly Crazy (aka com.pedrojayme.hogsflycrazy) application 1.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
815 CVE-2014-6870 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The BGEnergy (aka com.bluegrass.smartapps) application 1.153.0034 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
816 CVE-2014-6869 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The barcode scanner (aka tw.com.books.android.plus) application 2.3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
817 CVE-2014-6868 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The DS audio (aka com.synology.DSaudio) application 3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
818 CVE-2014-6867 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Sortir en Alsace (aka com.axessweb.sortirenalsace) application 0.5b for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
819 CVE-2014-6866 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The HomeAdvisor Mobile (aka com.servicemagic.consumer) application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
820 CVE-2014-6865 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Jamal Bates Show (aka com.conduit.app_3a95e13827c54c4da9056fafb33ecc8d.app) application 1.3.14.254 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
821 CVE-2014-6864 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Forest River Forums (aka com.socialknowledge.forestriverforums) application 3.7.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
822 CVE-2014-6863 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Mootorratturid & biker.ee (aka ee.digitalfruit.mootorratturid) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
823 CVE-2014-6862 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The ArtAcces (aka cat.gencat.mobi.artacces) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
824 CVE-2014-6861 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Terrarienbilder.com Forum (aka com.tapatalk.terrarienbildercomvb) application 3.8.20 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
825 CVE-2014-6860 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Trial Tracker (aka com.etcweb.android.trial_tracker) application 1.1.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
826 CVE-2014-6859 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Daum Maps - Subway (aka net.daum.android.map) application 3.9.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
827 CVE-2014-6858 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Mostafa Shemeas (aka com.mostafa.shemeas.website) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
828 CVE-2014-6857 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Car Wallpapers HD (aka com.arab4x4.gallery.app) application 1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
829 CVE-2014-6856 310 +Info 2014-10-02 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The AHRAH (aka com.vet2pet.aid219426) application 219426 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
830 CVE-2014-6855 310 +Info 2014-10-01 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Long (aka com.imop.longjiang.android) application 1.0.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
831 CVE-2014-6854 310 +Info 2014-10-01 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The EyeXam (aka com.globaleyeventures.eyexam) application 1.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
832 CVE-2014-6853 310 +Info 2014-10-01 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The Foxit MobilePDF - PDF Reader (aka com.foxit.mobile.pdf.lite) application 2.2.0.0616 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
833 CVE-2014-6852 310 +Info 2014-10-01 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The LedLine.gr Official (aka com.automon.ledline.gr) application 1.4.0.9 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
834 CVE-2014-6851 310 +Info 2014-10-01 2014-11-14
5.4
None Local Network Medium Not required Partial Partial Partial
The New Beginnings CFC (aka com.goodbarber.nbcfc) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
835 CVE-2014-6635 79 XSS 2014-10-26 2017-09-08
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php.
836 CVE-2014-6632 287 Bypass 2014-10-08 2014-10-09
7.5
None Remote Low Not required Partial Partial Partial
Joomla! 2.5.x before 2.5.25, 3.x before 3.2.4, and 3.3.x before 3.3.4 allows remote attackers to authenticate and bypass intended access restrictions via vectors involving LDAP authentication.
837 CVE-2014-6631 79 XSS 2014-10-08 2014-10-09
4.3
None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in com_media in Joomla! 3.2.x before 3.2.5 and 3.3.x before 3.3.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
838 CVE-2014-6611 20 2014-10-25 2015-01-28
4.3
None Remote Medium Not required None Partial None
The BlackBerry World app before 5.0.0.262 on BlackBerry 10 OS 10.2.0, before 5.0.0.263 on BlackBerry 10 OS 10.2.1, and before 5.1.0.53 on BlackBerry 10 OS 10.3.0 does not properly validate download/update requests, which allows user-assisted man-in-the-middle attackers to spoof servers and trigger the download of a crafted app by modifying the client-server data stream.
839 CVE-2014-6607 255 1 +Priv 2014-10-06 2014-10-07
7.5
None Remote Low Not required Partial Partial Partial
M/Monit 3.3.2 and earlier does not verify the original password before changing passwords, which allows remote attackers to change the password of other users and gain privileges via the fullname and password parameters, a different vulnerability than CVE-2014-6409.
840 CVE-2014-6603 399 DoS Bypass 2014-10-07 2018-10-09
5.0
None Remote Low Not required None None Partial
The SSHParseBanner function in SSH parser (app-layer-ssh.c) in Suricata before 2.0.4 allows remote attackers to bypass SSH rules, cause a denial of service (crash), or possibly have unspecified other impact via a crafted banner, which triggers a large memory allocation or an out-of-bounds write.
841 CVE-2014-6564 2014-10-15 2017-01-03
4.0
None Remote Low ??? None None Partial
Unspecified vulnerability in Oracle MySQL Server 5.6.19 and earlier allows remote authenticated users to affect availability via vectors related to SERVER:INNODB FULLTEXT SEARCH DML.
842 CVE-2014-6563 2014-10-15 2014-10-24
4.0
None Remote Low ??? Partial None None
Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality via unknown vectors, a different vulnerability than CVE-2014-4294, CVE-2014-4295, and CVE-2014-6538.
843 CVE-2014-6562 2014-10-15 2020-09-08
9.3
None Remote Medium Not required Complete Complete Complete
Unspecified vulnerability in Oracle Java SE 8u20 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
844 CVE-2014-6561 2014-10-15 2015-11-04
4.3
None Remote Medium Not required Partial None None
Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 12.0.4, 12.0.6, 12.1.1, 12.1.2, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors related to Separate Remittance Advice.
845 CVE-2014-6560 2014-10-15 2014-10-24
9.0
None Remote Low ??? Complete Complete Complete
Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2014-6453, CVE-2014-6467, and CVE-2014-6545.
846 CVE-2014-6559 2014-10-15 2018-12-18
4.3
None Remote Medium Not required Partial None None
Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier, and 5.6.20 and earlier, allows remote attackers to affect confidentiality via vectors related to C API SSL CERTIFICATE HANDLING.
847 CVE-2014-6558 2014-10-15 2020-09-08
2.6
None Remote High Not required None Partial None
Unspecified vulnerability in Oracle Java SE 5.0u71, 6u81, 7u67, and 8u20; Java SE Embedded 7u60; and JRockit R27.8.3 and JRockit R28.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.
848 CVE-2014-6557 2014-10-15 2015-11-13
4.9
None Remote Medium ??? Partial Partial None
Unspecified vulnerability in the Application Performance Management component in Oracle Enterprise Manager Grid Control before 12.1.0.6.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to End User Experience Management.
849 CVE-2014-6555 2014-10-15 2018-12-18
6.5
None Remote Low ??? Partial Partial Partial
Unspecified vulnerability in Oracle MySQL Server 5.5.39 and earlier and 5.6.20 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SERVER:DML.
850 CVE-2014-6554 2014-10-15 2015-11-13
5.5
None Remote Low ??? Partial Partial None
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.1 and 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console.
Total number of vulnerabilities : 1414   Page : 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 (This Page)18 19 20 21 22 23 24 25 26 27 28 29
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.