CVE-2017-11132

An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it...

CVE-2017-11134

The CVE-2017-11134 issue affects heinekingmedia StashCat for Android (up to version 1.7.5). The root cause is that login credentials are written to a log file on the device, allowing an attacker with access to the logs to read them. The connected sources corroborate this information across multip...

CVE-2017-11131

The CVE-2017-11131 issue affects heinekingmedia StashCat across Android (1.7.5), Web (0.0.80w), and Desktop (0.0.86). The root cause is hashing user passwords with SHA-512 without a salt or key-derivation function, and using only the first 32 bytes of the hash. This enables dictionary and rainbow...

CVE-2017-11130

This CVE affects heinekingmedia StashCat: Android up to 1.7.5, Web up to 0.0.80w, Desktop up to 0.0.86. Root cause: the protocol only aims to protect confidentiality; there are no integrity or authenticity checks in the entire protocol. Consequence: man-in-the-middle attackers can perform replay ...

CVE-2017-11133

CVE-2017-11133 affects heinekingmedia StashCat across Android (1.7.5), Web (0.0.80w), and Desktop (0.0.86). The issue is in the message encryption: AES in CBC mode is seeded with a pseudo‑random secret and IV generated by math.random(), with newer builds using CryptoJS.lib.WordArray.random() (whi...

CVE-2017-11129

Affected software: heinekingmedia StashCat for Android (versions up to 1.7.5).Root cause: keystore protected by a hard-coded password, enabling access to keystore contents by anyone with keystore access (e.g., private keys).Impact: potential unauthorized reading of sensitive data stored in the ke...