CVE-2020-14449

Technical details are not publicly provided in the supplied documents. The materials mention Mattermost Mobile Apps before 1.30.0 and token disclosure to third-party servers, but no concrete guidance on affected components, exploit methods, or fixes is included. Monitor updates.

CVE-2020-14449

An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018...

CVE-2019-20851: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Mattermost Mobile Apps before 1.26.0. An attacker can use directory traversal with the Video Preview feature to overwrite arbitrary files on a device...

PT-2020-14009

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 1.30.0 Description An issue was discovered where authorization tokens can sometimes be disclosed to third-party servers. Recommendations For versions prior to 1.30.0, update to version 1.30.0 or later t...

CVE-2019-20849: Incomplete Cleanup

An issue was discovered in Mattermost Mobile Apps before 1.26.0. Cookie data can persist on a device after a logout...

PT-2020-10811

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 1.26.0 Description An issue was discovered in the Quick Reply feature, which mishandles crafted replies. Recommendations For versions prior to 1.26.0, update to version 1.26.0 or later to resolve the...

PT-2020-10815

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 1.26.0 Description An issue was discovered where local logging is not blocked for sensitive information, such as server addresses or message content. Recommendations For versions prior to 1.26.0, update...

PT-2020-10813

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 1.26.0 Description An issue was discovered where a view cache can persist on a device after a logout, potentially leading to unauthorized access to sensitive information. Recommendations For versions...

PT-2020-10812

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 1.26.0 Description An issue allows cookie data to persist on a device after a user logs out. Recommendations For versions prior to 1.26.0, update to version 1.26.0 or later to resolve the issue...

PT-2020-10814

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 1.26.0 Description An issue allows an attacker to use directory traversal with the Video Preview feature to overwrite arbitrary files on a device. Recommendations For versions prior to 1.26.0, update to...

CVE-2019-20850: Incomplete Cleanup

An issue was discovered in Mattermost Mobile Apps before 1.26.0. A view cache can persist on a device after a logout...

CVE-2019-20848: Improper Input Validation

An issue was discovered in Mattermost Mobile Apps before 1.26.0. The Quick Reply feature mishandles crafted replies...

PT-2020-14011

Name of the Vulnerable Software and Affected Versions Mattermost Mobile Apps versions prior to 1.29.0 Description An issue was discovered in the iOS app where Single Sign-On cookies and Local Storage remained after a logout. Recommendations For versions prior to 1.29.0, update to version 1.29.0 o...

CVE-2020-14449: Undefined Security Weakness

An issue was discovered in Mattermost Mobile Apps before 1.30.0. Authorization tokens can sometimes be disclosed to third-party servers, aka MMSA-2020-0018...

CVE-2020-14451: Incomplete Cleanup

An issue was discovered in Mattermost Mobile Apps before 1.29.0. The iOS app allowed Single Sign-On cookies and Local Storage to remain after a logout, aka MMSA-2020-0013...

CVE-2019-20852: Insertion of Sensitive Information into Log File

An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information e.g., server addresses or message content...

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

IC3 Releases Alert on Mobile Banking Apps

The Internet Crime Complaint Center IC3 has released an alert warning consumers of cyber risks associated with mobile banking apps. As more consumers rely on mobile apps for banking, malicious cyber actors are likely to increasingly target them with app-based banking Trojans and fake banking apps...

Over 4000 Android Apps Expose Users' Data via Misconfigured Firebase Databases

More than 4,000 Android apps that use Google's cloud-hosted Firebase databases are 'unknowingly' leaking sensitive information on their users, including their email addresses, usernames, passwords, phone numbers, full names, chat messages and location data. The investigation, led by Bob Diachenko...

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...