The State Bank Anywhere (aka com.sbi.SBIFreedomPlus) application 2.0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Export limit exceeded: 18405 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search vulnerabilities
CVE-2014-5954
CVSS 2.0 · 5.4 Medium
EPSS < 1%
KEV · Not listed
Vendors
Products
CVE-2018-17404
The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile number, PAN number (from a government-issued ID), and date of birth.
CVSS 3.0 · 5.3 Medium
EPSS < 1%
KEV · Not listed
Vendors
Products
CVE-2018-17108
The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow attackers to perform Account Takeover attacks by intercepting a security-question response during the initial configuration of the application.
CVSS 3.0 · 8.8 High
EPSS 1.1%
KEV · Not listed
Vendors
Products
Page 1 of 1.