https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-15999.htmlhttps://patchthecve.com/cve/CVE-2017-15999.htmlWed, 17 Jun 2026 01:08:37 +0000CRITICAL 9.8: In the "NQ Contacts Backup & Restore" application 1.1 for Android, no HTTPS is used for transmitting login and synced user data. When logging in, the username is transmitted in cleartext along with an SHA-1 hash of the password. The attacker can either crack this hash or use it for further attacks whttps://patchthecve.com/cve/CVE-2017-15998.htmlhttps://patchthecve.com/cve/CVE-2017-15998.htmlWed, 17 Jun 2026 01:08:37 +0000HIGH 7.5: In the "NQ Contacts Backup & Restore" application 1.1 for Android, DES encryption with a static key is used to secure transmitted contact data. This makes it easier for remote attackers to obtain cleartext information by sniffing the network.https://patchthecve.com/cve/CVE-2017-15997.htmlhttps://patchthecve.com/cve/CVE-2017-15997.htmlWed, 17 Jun 2026 01:08:37 +0000HIGH 7.8: In the "NQ Contacts Backup & Restore" application 1.1 for Android, RC4 encryption is used to secure the user password locally stored in shared preferences. Because there is a static RC4 key, an attacker can gain access to user credentials more easily by leveraging access to the preferences XML file.https://patchthecve.com/cve/CVE-2014-5764.htmlhttps://patchthecve.com/cve/CVE-2014-5764.htmlWed, 17 Jun 2026 00:12:01 +0000MEDIUM 5.4: The Antivirus Free (aka com.zrgiu.antivirus) application 7.2.16.02 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.https://patchthecve.com/cve/CVE-2014-5673.htmlhttps://patchthecve.com/cve/CVE-2014-5673.htmlWed, 17 Jun 2026 00:11:52 +0000MEDIUM 5.4: The Easy Finder & Anti-Theft (aka com.nqmobile.easyfinder) application 2.0.10.08 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.https://patchthecve.com/cve/CVE-2014-5672.htmlhttps://patchthecve.com/cve/CVE-2014-5672.htmlWed, 17 Jun 2026 00:11:52 +0000MEDIUM 5.4: The NQ Mobile Security & Antivirus (aka com.nqmobile.antivirus20) application 7.2.16.00 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.https://patchthecve.com/cve/CVE-2014-5667.htmlhttps://patchthecve.com/cve/CVE-2014-5667.htmlWed, 17 Jun 2026 00:11:52 +0000MEDIUM 5.4: The Vault-Hide SMS, Pics & Videos (aka com.netqin.ps) application 5.0.14.22 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.