Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,968 results · page 7 of 40
Dec 15, 2017Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPCVE-2017-3190 · Other software · Flash Seats · reported by cret@cert.orgHigh 7.5
Flash Seats Mobile App for Android version 1.7.9 and earlier and for iOS version 1.9.51 and earlier fails to properly validate SSL certificates provided by HTTPS connections, which may enable an attacker to conduct man-in-the-middle (MITM) attacks.
- Product
- Flash Seats Mobile App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Oct 13, 2017Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modificationsCVE-2017-10624 · Network & remote access · Juniper Networks · reported by sirt@juniper.netHigh 7.5
Insufficient verification of node certificates in Juniper Networks Junos Space may allow a man-in-the-middle type of attacker to make unauthorized modifications to Space database or add nodes. Affected releases are Juniper Networks Junos Space all versions prior to 17.1R1.
- Product
- Junos Space
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.juniper.net
Oct 12, 2017Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographCVE-2015-6358 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.9
Multiple Cisco embedded devices use hardcoded X.509 certificates and SSH host keys embedded in the firmware, which allows remote attackers to defeat cryptographic protection mechanisms and conduct man-in-the-middle attacks by leveraging knowledge of these certificates and keys from another installation, aka Bug IDs CSCuw46610, CSCuw46620, CSCuw46637, CSCuw46654, CSCuw46665, CSCuw46672, CSCuw46677, CSCuw46682, CSCuw46705, CSCuw46716, CSCuw46979, CSCuw47005, CSCuw47028, CSCuw47040, CSCuw47048, CSCuw47061, CSCuw90860, CSCuw90869, CSCuw90875, CSCuw90881, CSCuw90899, and CSCuw90913.
- Product
- Rv320 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtools.cisco.comkb.cert.org
Oct 10, 2017Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.CVE-2015-7778 · Other software · Gurunavi · reported by vultures@jpcert.or.jpMedium 5.9
Gurunavi App for iOS before 6.0.0 does not verify SSL certificates which could allow remote attackers to perform man-in-the-middle attacks.
- Product
- Gournavi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2017niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks.CVE-2015-5639 · Other software · Dwango · reported by vultures@jpcert.or.jpHigh 7.4
niconico App for iOS before 6.38 does not verify SSL certificates which could allow remote attackers to execute man-in-the-middle attacks.
- Product
- Niconico
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nicovideo.jpjvn.jp
Oct 10, 2017Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middle attacks.CVE-2015-2988 · Other software · Rakutencard · reported by vultures@jpcert.or.jpHigh 7.4
Rakuten card App for iOS 5.2.0 through 5.2.4 does not verify SSL certificates which might allow remote attackers to execute man-in-the-middle attacks.
- Product
- Rakuten Card
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2017CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorizCVE-2014-2903 · Other software · Wolfssl · reported by MITREMedium 5.9
CyaSSL does not check the key usage extension in leaf certificates, which allows remote attackers to spoof servers via a crafted server certificate not authorized for use in an SSL/TLS handshake.
- Product
- Wolfssl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comopenwall.com
Oct 4, 2017On Darwin, user's trust preferences for root certificates were not honored.CVE-2017-1000097 · Other software · Golang · reported by MITREHigh 7.5
On Darwin, user's trust preferences for root certificates were not honored. If the user had a root certificate loaded in their Keychain that was explicitly not trusted, a Go program would still verify a connection using that root certificate.
- Product
- GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgo-review.googlesource.com
Sep 29, 2017The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middleCVE-2017-14582 · Email & office · Zohocorp · reported by MITREMedium 5.9
The Zoho Site24x7 Mobile Network Poller application before 1.1.5 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a self-signed certificate.
- Product
- Site24x7 Mobile Network Poller
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comwwws.nightwatchcybersecurity.com
Sep 26, 2017Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encCVE-2015-0874 · Other software · OKB · reported by vultures@jpcert.or.jpMedium 5.9
Smartphone Passbook 1.0.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to obtain sensitive information from encrypted communications via a crafted certificate.
- Product
- Smart Passbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2017GANMA! App for iOS does not verify SSL certificates.CVE-2015-7785 · Other software · Comicsmart · reported by vultures@jpcert.or.jpMedium 5.9
GANMA! App for iOS does not verify SSL certificates.
- Product
- Ganma!
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 25, 2017ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates.CVE-2015-5666 · Other software · ANA · reported by vultures@jpcert.or.jpMedium 5.9
ANA App for Android 3.1.1 and earlier, and ANA App for iOS 3.3.6 and earlier does not verify SSL certificates.
- Product
- ALL Nippon Airways
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2017The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permittinCVE-2016-10511 · Other software · Twitter · reported by support@hackerone.comMedium 5.9
The Twitter iOS client versions 6.62 and 6.62.1 fail to validate Twitter's server certificates for the /1.1/help/settings.json configuration endpoint, permitting man-in-the-middle attackers the ability to view an application-only OAuth client token and potentially enable unreleased Twitter iOS app features.
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comhackerone.com
Sep 6, 2017Honda Moto LINC 1.6.1 does not verify SSL certificates.CVE-2015-2943 · Other software · Honda · reported by vultures@jpcert.or.jpMedium 5.9
Honda Moto LINC 1.6.1 does not verify SSL certificates.
- Product
- Moto Linc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2017ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allowCVE-2015-7255 · Other software · ZTE · reported by cret@cert.orgHigh 7.5
ZTE OX-330P, ZXHN H108N, W300V1.0.0S_ZRD_TR1_D68, HG110, GAN9.8T101A-B, MF28G, ZXHN H108N use non-unique X.509 certificates and SSH host keys, which might allow remote attackers to obtain credentials or other sensitive information via a man-in-the-middle attack, passive decryption attack, or impersonating a legitimate device.
- Product
- Ox-330p Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2017Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.CVE-2015-4017 · Other software · Saltstack · reported by MITREHigh 7.5
Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Aug 18, 2017OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.CVE-2014-3451 · Other software · Igniterealtime · reported by MITREHigh 7.5
OpenFire XMPP Server before 3.10 accepts self-signed certificates, which allows remote attackers to perform unspecified spoofing attacks.
- Product
- Openfire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comopenwall.com
Aug 9, 2017Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash serCVE-2015-5619 · Other software · Elastic · reported by MITREMedium 5.9
Logstash 1.4.x before 1.4.5 and 1.5.x before 1.5.4 with Lumberjack output or the Logstash forwarder does not validate SSL/TLS certificates from the Logstash server, which might allow attackers to obtain sensitive information via a man-in-the-middle attack.
- Product
- Logstash
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Aug 4, 2017MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication.CVE-2017-10819 · Other software · Intercom, Inc. · reported by vultures@jpcert.or.jpMedium 5.9
MaLion for Mac 4.3.0 to 5.2.1 does not properly validate certificates, which may allow an attacker to eavesdrop on an encrypted communication.
- Product
- MaLion for Mac
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2017The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL sCVE-2017-2278 · Other software · IID, Inc. · reported by vultures@jpcert.or.jpMedium 5.9
The RBB SPEED TEST App for Android version 2.0.3 and earlier, RBB SPEED TEST App for iOS version 2.1.0 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- RBB SPEED TEST App for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2017The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information vCVE-2015-0904 · Other software · Shidax · reported by vultures@jpcert.or.jpMedium 5.9
The Restaurant Karaoke SHIDAX app 1.3.3 and earlier on Android does not verify SSL certificates, which allows remote attackers to obtain sensitive information via a man-in-the-middle attack.
- Product
- Restaurant Karaoke
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2017libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.CVE-2015-3886 · Other software · Libinfinity Project · reported by MITRECritical 9.8
libinfinity before 0.6.6-1 does not validate expired SSL certificates, which allows remote attackers to have unspecified impact via unknown vectors.
- Product
- Libinfinity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgbugs.debian.org
Jun 21, 2017Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic.CVE-2017-3218 · Computers, phones & browsers · Samsung · reported by cret@cert.orgHigh 8.8
Samsung Magician 5.0 fails to validate TLS certificates for HTTPS software update traffic. Prior to version 5.0, Samsung Magician uses HTTP for software updates.
- Product
- Magician
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comkb.cert.org
Jun 16, 2017The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates froCVE-2017-9601 · Other software · Fnbkemp · reported by MITREMedium 5.9
The "FNB Kemp Mobile Banking" by First National Bank of Kemp app 3.0.2 -- aka fnb-kemp-mobile-banking/id571448725 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- FNB Kemp Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- aka peoples-bank-tulsa/id1074279285 for iOS does not verify X.509 certificates from SSL servers, whicCVE-2017-9600 · Other software · Meafinancial · reported by MITREMedium 5.9
The "Peoples Bank Tulsa" by Peoples Bank - OK app 3.0.2 -- aka peoples-bank-tulsa/id1074279285 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Peoples Bank Tulsa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "CFB Mobile Banking" by Citizens First Bank Wisconsin app 3.0.1 -- aka cfb-mobile-banking/id1081102805 for iOS does not verify X.509 certificates from SSL sCVE-2017-9596 · Other software · Meafinancial · reported by MITREMedium 5.9
The "CFB Mobile Banking" by Citizens First Bank Wisconsin app 3.0.1 -- aka cfb-mobile-banking/id1081102805 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- CFB Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "SVB Mobile" by Sauk Valley Bank Mobile Banking app 3.0.0 -- aka svb-mobile/id796429885 for iOS does not verify X.509 certificates from SSL servers, which aCVE-2017-9594 · Other software · Meafinancial · reported by MITREMedium 5.9
The "SVB Mobile" by Sauk Valley Bank Mobile Banking app 3.0.0 -- aka svb-mobile/id796429885 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- SVB Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "Oculina Mobile Banking" by Oculina Bank app 3.0.0 -- aka oculina-mobile-banking/id867025690 for iOS does not verify X.509 certificates from SSL servers, whCVE-2017-9593 · Other software · Meafinancial · reported by MITREMedium 5.9
The "Oculina Mobile Banking" by Oculina Bank app 3.0.0 -- aka oculina-mobile-banking/id867025690 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Oculina Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "PCB Mobile" by Phelps County Bank app 3.0.2 -- aka pcb-mobile/id436891295 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-CVE-2017-9591 · Other software · Mypcb · reported by MITREMedium 5.9
The "PCB Mobile" by Phelps County Bank app 3.0.2 -- aka pcb-mobile/id436891295 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- PCB Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verify X.509 certificates from SSL servers, whCVE-2017-9588 · Other software · Meafinancial · reported by MITREMedium 5.9
The "Oritani Mobile Banking" by Oritani Bank app 3.0.0 -- aka oritani-mobile-banking/id778851066 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Oritani Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certificates from SSL servers, which allows manCVE-2017-9587 · Other software · Meafinancial · reported by MITREMedium 5.9
The "PCSB BANK Mobile" by PCSB Bank app 3.0.4 -- aka pcsb-bank-mobile/id1067472090 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Pcsb Bank Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "FSBY Mobile Banking" by First State Bank of Yoakum TX app 3.0.0 -- aka fsby-mobile-banking/id899136434 for iOS does not verify X.509 certificates from SSL CVE-2017-9586 · Other software · Meafinancial · reported by MITREMedium 5.9
The "FSBY Mobile Banking" by First State Bank of Yoakum TX app 3.0.0 -- aka fsby-mobile-banking/id899136434 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Fsby Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers,CVE-2017-9584 · Other software · Heritagebankozarks · reported by MITREMedium 5.9
The "HBO Mobile Banking" by Heritage Bank of Ozarks app 3.0.0 -- aka hbo-mobile-banking/id860224933 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- HBO Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "Charlevoix State Bank" by Charlevoix State Bank app 3.0.1 -- aka charlevoix-state-bank/id1128963717 for iOS does not verify X.509 certificates from SSL serCVE-2017-9583 · Other software · Meafinancial · reported by MITREMedium 5.9
The "Charlevoix State Bank" by Charlevoix State Bank app 3.0.1 -- aka charlevoix-state-bank/id1128963717 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Charlevoix State Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "BNB Mobile Banking" by Brady National Bank app 3.0.0 -- aka bnb-mobile-banking/id674215747 for iOS does not verify X.509 certificates from SSL servers, whiCVE-2017-9582 · Other software · Bradynationalbank · reported by MITREMedium 5.9
The "BNB Mobile Banking" by Brady National Bank app 3.0.0 -- aka bnb-mobile-banking/id674215747 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- BNB Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "JMCU Mobile Banking" by Joplin Metro Credit Union app 3.0.0 -- aka jmcu-mobile-banking/id716065893 for iOS does not verify X.509 certificates from SSL servCVE-2017-9579 · Other software · Meafinancial · reported by MITREMedium 5.9
The "JMCU Mobile Banking" by Joplin Metro Credit Union app 3.0.0 -- aka jmcu-mobile-banking/id716065893 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Jmcu Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "RVCB Mobile" by RVCB Mobile Banking app 3.0.0 -- aka rvcb-mobile/id757928895 for iOS does not verify X.509 certificates from SSL servers, which allows man-CVE-2017-9578 · Other software · Rivervalleycommunitybank · reported by MITREMedium 5.9
The "RVCB Mobile" by RVCB Mobile Banking app 3.0.0 -- aka rvcb-mobile/id757928895 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Rvcb Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSCVE-2017-9575 · Other software · Meafinancial · reported by MITREMedium 5.9
The "FVB Mobile Banking" by First Volunteer Bank of Tennessee app 3.1.1 -- aka fvb-mobile-banking/id551018004 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- FVB Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The North Adams State Bank (Ursa) nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-theCVE-2017-9573 · Other software · Northadamsbank · reported by MITREMedium 5.9
The North Adams State Bank (Ursa) nasb-mobile-banking/id980573797 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Nasb Mobile Bank
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackersCVE-2017-9572 · Other software · Athensstatebank · reported by MITREMedium 5.9
The athens-state-bank-mobile-banking/id719748589 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Athens State Bank Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The Citizens Community Bank (TN) ccb-mobile-banking/id610030469 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-mCVE-2017-9571 · Other software · Ccbank · reported by MITREMedium 5.9
The Citizens Community Bank (TN) ccb-mobile-banking/id610030469 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- CCB Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The mount-vernon-bank-trust-mobile-banking/id542706679 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attCVE-2017-9570 · Other software · Meafinancial · reported by MITREMedium 5.9
The mount-vernon-bank-trust-mobile-banking/id542706679 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Mount Vernon Bank & Trust Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The Citizens Bank (TX) cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackerCVE-2017-9569 · Other software · Citizensbanktx · reported by MITREMedium 5.9
The Citizens Bank (TX) cbtx-on-the-go/id892396102 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Cbtx ON The GO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers toCVE-2017-9568 · Other software · Myfpcu · reported by MITREMedium 5.9
The financial-plus-mobile-banking/id731070564 app 3.0.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Financial Plus Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoofCVE-2017-9567 · Other software · Meafinancial · reported by MITREMedium 5.9
The avb-bank-mobile-banking/id592565443 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- AVB Bank Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to sCVE-2017-9566 · Other software · Meafinancial · reported by MITREMedium 5.9
The fsb-dequeen-mobile-banking/id1091025340 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- FSB Dequeen Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attaCVE-2017-9565 · Other software · Meafinancial · reported by MITREMedium 5.9
The first-security-bank-sleepy-eye-mobile/id870531890 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- First Security Bank Sleepy EYE Mobile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof sCVE-2017-9564 · Other software · Meafinancial · reported by MITREMedium 5.9
The community-banks-cb2go/id445828071 app 3.1.3 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Community Banks Cb2go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackeCVE-2017-9563 · Other software · Meafinancial · reported by MITREMedium 5.9
The First Citizens Community Bank fccb/id809930960 app 3.0.1 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Fccb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2017The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-iCVE-2017-9562 · Other software · Meafinancial · reported by MITREMedium 5.9
The Freedom First freedom-1st-credit-union-mobile-banking/id1085229458 app 3.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Freedom 1st Credit Union Mobile Banking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.