CVE-2017-11132

An issue was discovered in heinekingmedia StashCat before 1.5.18 for Android. No certificate pinning is implemented; therefore the attacker could issue a certificate for the backend and the application would not notice it...

CVE-2017-11129

Affected software: heinekingmedia StashCat for Android (versions up to 1.7.5).Root cause: keystore protected by a hard-coded password, enabling access to keystore contents by anyone with keystore access (e.g., private keys).Impact: potential unauthorized reading of sensitive data stored in the ke...

CVE-2017-11134

The CVE-2017-11134 issue affects heinekingmedia StashCat for Android (up to version 1.7.5). The root cause is that login credentials are written to a log file on the device, allowing an attacker with access to the logs to read them. The connected sources corroborate this information across multip...

CVE-2017-11136

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backen...

CVE-2017-11132

The CVE-2017-11132 issue affects heinekingmedia StashCat for Android (pre-1.5.18). The root cause is missing certificate pinning, allowing an attacker to issue a certificate for the backend and have the application trust it without notice. Public references in the provided documents describe the ...

CVE-2017-11133

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random in previous versions and with...