CVE-2020-13129

Stashcat app (versions up to 3.9.1 on macOS/Windows/Android/iOS) is affected by a information-disclosure flaw where a GET request includes client_key and device_id in the query string, allowing an observer with access to web server logs to read sensitive data. CVSSv3.1 base score 7.2 ( HIGH ) wit...

CVE-2020-13129

An issue was discovered in the stashcat app through 3.9.1 for macOS, Windows, Android, iOS, and possibly other platforms. The GET method is used with clientkey and deviceid data in the query string, which allows attackers to obtain sensitive information by reading web-server logs...

heinekingmedia StashCat Weak Password Vulnerability

heinekingmedia StashCat for Android, Web and Desktop are all products of the German company heinekingmedia. heinekingmedia StashCat for Android is an Android-based enterprise communication software. heinekingmedia StashCat for Web is the Web-based version and heinekingmedia StashCat for Desktop i...

heinekingmedia StashCat Password Attack Vulnerability

heinekingmedia StashCat for Android is an Android-based enterprise communication software from the German company heinekingmedia. heinekingmedia StashCat suffers from a password attack vulnerability that stems from user passwords being hashed directly with SHA-512. By exploiting this vulnerabilit...

heinekingmedia StashCat Certificate Backend Vulnerability

heinekingmedia StashCat for Android is an Android-based enterprise communication software from the German company heinekingmedia. A certificate backend vulnerability exists in heinekingmedia StashCat. An attacker can issue back-end certificates undetected by the application...

heinekingmedia StashCat for Android Hardcoded Password Vulnerability

heinekingmedia StashCat for Android is an Android-based enterprise communication software from the German company heinekingmedia. A security vulnerability exists in heinekingmedia StashCat 1.7.5 and earlier versions for the Android platform, which stems from the program's use of hard-coded...

heinekingmedia StashCat for Android, Web and Desktop Man-in-the-Middle Attack Vulnerability

heinekingmedia StashCat for Android, Web and Desktop are all products of the German company heinekingmedia. heinekingmedia StashCat for Android is an Android-based enterprise communication software. heinekingmedia StashCat for Web is the web-based version and heinekingmedia StashCat for Desktop i...

heinekingmedia StashCat for Android, Web and Desktop Arbitrary File Read Vulnerability

heinekingmedia StashCat for Android, Web and Desktop are all products of the German company heinekingmedia. heinekingmedia StashCat for Android is an Android-based enterprise communication software. heinekingmedia StashCat for Web is the web-based version and heinekingmedia StashCat for Desktop i...

heinekingmedia StashCat for Android, Web and Desktop Denial of Service Vulnerability

heinekingmedia StashCat for Android, Web and Desktop are all products of the German company heinekingmedia. heinekingmedia StashCat for Android is an Android-based enterprise communication software. heinekingmedia StashCat for Web is the Web-based version and heinekingmedia StashCat for Desktop i...

heinekingmedia StashCat for Android Information Disclosure Vulnerability

heinekingmedia StashCat for Android is an Android-based enterprise communication software from the German company heinekingmedia. A security vulnerability exists in heinekingmedia StashCat 1.7.5 and earlier versions for the Android platform. An attacker can exploit the vulnerability to read login...

CVE-2017-11133

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random in previous versions and with...

Authentication flaw

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for...

CVE-2017-11135

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be...

CVE-2017-11132

An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it...

CVE-2017-11130

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle...

CVE-2017-11134

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them...

CVE-2017-11136

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backen...

CVE-2017-11136

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backen...

Design/Logic Flaw

An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it...

CVE-2017-11129

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with access to the keystore can read the content out, for example the private key of the user...