CVE-2017-5915

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The Emirates NBD Bank P.J.S.C Emirates NBD KSA app 3.10.0 through 3.10.4 (UAE) and 2.0.1 through 2.1.0 (KSA) for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-59165.9The America's First Federal Credit Union (FCU) Mobile Banking app 3.1.0 for iOS does not verify X.509 certificates from SSL servers, which a CVE-2017-59185.9The Banco de Costa Rica BCR Movil app 3.7 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attack CVE-2017-59195.9The 21st Century Insurance app 10.0.0 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers CVE-2017-59237.5libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (heap-based out-of-bounds read and application crash) v CVE-2017-59247.5libyara/grammar.y in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted ru CVE-2017-59257.5Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel p CVE-2017-59267.5Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD pro CVE-2017-59277.5Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM pro CVE-2017-59283.7The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a CVE-2017-59299.8QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.CVE-2017-59302.7The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete CVE-2017-59318.8Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of servi