CVE-2016-4818

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

DMMFX Trade for Android 1.5.0 and earlier, DMMFX DEMO Trade for Android 1.5.0 and earlier, and GAITAMEJAPAN FX Trade for Android 1.4.0 and earlier do not verify SSL certificates.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://fx.dmm.com/information/press/2016/2016053001/Vendor Advisory
http://jvn.jp/en/jp/JVN40898764/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000092.htmlThird Party Advisory, VDB Entry
http://www.gaitamejapan.com/support/news/2016/2016053001/Third Party Advisory
https://jvn.jp/en/jp/JVN40898764/995849/index.htmlThird Party Advisory, VDB Entry
http://fx.dmm.com/information/press/2016/2016053001/Vendor Advisory
http://jvn.jp/en/jp/JVN40898764/index.htmlThird Party Advisory, VDB Entry
http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000092.htmlThird Party Advisory, VDB Entry
http://www.gaitamejapan.com/support/news/2016/2016053001/Third Party Advisory
https://jvn.jp/en/jp/JVN40898764/995849/index.htmlThird Party Advisory, VDB Entry

Timeline

Published: Apr 20, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-48199.8The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b, DX Library for Gnu C++ 3.13f through 3.16b, and DX Li CVE-2016-48208.8Cross-site request forgery (CSRF) vulnerability on I-O DATA DEVICE ETX-R devices allows remote attackers to hijack the authentication of arb CVE-2016-48215.3I-O DATA DEVICE ETX-R devices allow remote attackers to cause a denial of service (web-server crash) via unspecified vectors.CVE-2016-48228.0Corega CG-WLBARGL devices allow remote authenticated users to execute arbitrary commands via unspecified vectors.CVE-2016-48237.5Corega CG-WLBARAGM devices allow remote attackers to cause a denial of service (reboot) via unspecified vectors.CVE-2016-48245.3The Wi-Fi Protected Setup (WPS) implementation on Corega CG-WLR300GNV and CG-WLR300GNV-W devices does not restrict the number of PIN authent CVE-2016-48255.6The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute CVE-2016-48266.1Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to injec CVE-2016-48276.1Cross-site scripting (XSS) vulnerability in the Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to injec CVE-2016-48286.5The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress mishandles sessions, which allows remote attackers to obtain access by lever CVE-2016-48295.9DMM Movie Player App for Android before 1.2.1, and DMM Movie Player App for iPhone/iPad before 2.1.3 does not verify SSL certificates.CVE-2016-48305.9Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.