CVE-2012-5456

The Zoner AntiVirus Free application for Android does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, as demonstrated by a server used for updating virus signature files.

• CWE-310

• http://www.securityfocus.com/bid/56292Third Party Advisory, VDB Entry
• http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdfBroken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79591Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/56292Third Party Advisory, VDB Entry
• http://www2.dcsec.uni-hannover.de/files/android/p50-fahl.pdfBroken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79591Third Party Advisory, VDB Entry

Published

Oct 24, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-5450Cross-site request forgery (CSRF) vulnerability in lib/filem…
• CVE-2012-5451Multiple stack-based buffer overflows in HttpUtils.dll in TV…
• CVE-2012-5452Multiple cross-site scripting (XSS) vulnerabilities in Subri…
• CVE-2012-5453SQL injection vulnerability in user/index_inline_editor_subm…
• CVE-2012-5454user/index_inline_editor_submit.php in ATutor AContent 1.2-1…
• CVE-2012-5455Cross-site scripting (XSS) vulnerability in the language sea…
• CVE-2012-5458VMware Workstation 8.x before 8.0.5 and VMware Player 4.x be…
• CVE-2012-5459Untrusted search path vulnerability in VMware Workstation 8.…
• CVE-2012-5460Cross-site scripting (XSS) vulnerability in the help page in…
• CVE-2012-5468Heap-based buffer overflow in iconvert.c in the bogolexer co…
• CVE-2012-5469The Portable phpMyAdmin plugin before 1.3.1 for WordPress al…
• CVE-2012-5470libpng_plugin in VideoLAN VLC media player 2.0.3 allows remo…