RSS   Vulnerabilities for 'Stashcat'   RSS

2020-06-17
 
CVE-2020-13637

CWE-312
 

 
An issue was discovered in the stashcat app through 3.9.2 for macOS, Windows, Android, iOS, and possibly other platforms. It stores the client_key, the device_id, and the public key for end-to-end encryption in cleartext, enabling an attacker (by copying or having access to the local storage database file) to login to the system from any other computer, and get unlimited access to all data in the users's context.

 
2020-05-18
 
CVE-2020-13129

CWE-200
 

 
An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms. The GET method is used with client_key and device_id data in the query string, which allows attackers to obtain sensitive information by reading web-server logs.

 
2017-08-01
 
CVE-2017-11132

CWE-295
 

 
An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it.

 


Copyright 2024, cxsecurity.com

 

Back to Top