Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
StashcatHeinekingmedia

7 matches found

CVE
CVE•added 2017/08/01 2:29 p.m.•38 views

CVE-2017-11131

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for authenticatio...

5.9CVSS5.8AI score0.00136EPSS
CVE
CVE•added 2017/08/01 2:29 p.m.•38 views

CVE-2017-11135

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be inter...

7.5CVSS7.4AI score0.00296EPSS
CVE
CVE•added 2017/08/01 2:29 p.m.•38 views

CVE-2017-11136

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backend,...

6.5CVSS6.3AI score0.00143EPSS
CVE
CVE•added 2017/08/01 2:29 p.m.•35 views

CVE-2017-11129

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with access to the keystore can read the content out, for example the private key of the user.

9.8CVSS9.1AI score0.00345EPSS
CVE
CVE•added 2017/08/01 2:29 p.m.•35 views

CVE-2017-11130

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attack...

8.1CVSS7.9AI score0.00156EPSS
CVE
CVE•added 2017/08/01 2:29 p.m.•33 views

CVE-2017-11134

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them.

6.5CVSS6.3AI score0.00259EPSS
CVE
CVE•added 2017/08/01 2:29 p.m.•32 views

CVE-2017-11133

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with Cryp...

7.5CVSS7.5AI score0.0014EPSS