CVE-2017-11134

The CVE-2017-11134 issue affects heinekingmedia StashCat for Android (up to version 1.7.5). The root cause is that login credentials are written to a log file on the device, allowing an attacker with access to the logs to read them. The connected sources corroborate this information across multip...

CVE-2017-11135

CVE-2017-11135 affects heinekingmedia StashCat on Android (up to v1.7.5), Web (up to v0.0.80w) and Desktop (up to v0.0.86). Root cause: the logout mechanism does not check authorization, allowing an attacker who knows the device ID to cause a denial of service. The vulnerability stems from client...

CVE-2017-11135

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be...

CVE-2017-11129

Affected software: heinekingmedia StashCat for Android (versions up to 1.7.5).Root cause: keystore protected by a hard-coded password, enabling access to keystore contents by anyone with keystore access (e.g., private keys).Impact: potential unauthorized reading of sensitive data stored in the ke...

CVE-2017-11133

CVE-2017-11133 affects heinekingmedia StashCat across Android (1.7.5), Web (0.0.80w), and Desktop (0.0.86). The issue is in the message encryption: AES in CBC mode is seeded with a pseudo‑random secret and IV generated by math.random(), with newer builds using CryptoJS.lib.WordArray.random() (whi...

CVE-2017-11130

This CVE affects heinekingmedia StashCat: Android up to 1.7.5, Web up to 0.0.80w, Desktop up to 0.0.86. Root cause: the protocol only aims to protect confidentiality; there are no integrity or authenticity checks in the entire protocol. Consequence: man-in-the-middle attackers can perform replay ...