{"id": "SECURITYVULNS:VULN:14430", "bulletinFamily": "software", "title": "Different iOS / Android applications vulnerabilities", "description": "Information leaks, code execution, protection bypass, etc.", "published": "2015-10-25T00:00:00", "modified": "2015-10-25T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:14430", "reporter": " ", "references": ["https://vulners.com/securityvulns/securityvulns:doc:32508", "https://vulners.com/securityvulns/securityvulns:doc:32139", "https://vulners.com/securityvulns/securityvulns:doc:31970", "https://vulners.com/securityvulns/securityvulns:doc:32588", "https://vulners.com/securityvulns/securityvulns:doc:31968", "https://vulners.com/securityvulns/securityvulns:doc:31966", "https://vulners.com/securityvulns/securityvulns:doc:32140", "https://vulners.com/securityvulns/securityvulns:doc:31971", "https://vulners.com/securityvulns/securityvulns:doc:31965", "https://vulners.com/securityvulns/securityvulns:doc:32589", "https://vulners.com/securityvulns/securityvulns:doc:32143", "https://vulners.com/securityvulns/securityvulns:doc:32017", "https://vulners.com/securityvulns/securityvulns:doc:32587", "https://vulners.com/securityvulns/securityvulns:doc:32590", "https://vulners.com/securityvulns/securityvulns:doc:32591", "https://vulners.com/securityvulns/securityvulns:doc:31974", "https://vulners.com/securityvulns/securityvulns:doc:31967", "https://vulners.com/securityvulns/securityvulns:doc:32138", "https://vulners.com/securityvulns/securityvulns:doc:31972", "https://vulners.com/securityvulns/securityvulns:doc:31973", "https://vulners.com/securityvulns/securityvulns:doc:32018", "https://vulners.com/securityvulns/securityvulns:doc:32586", "https://vulners.com/securityvulns/securityvulns:doc:32011", "https://vulners.com/securityvulns/securityvulns:doc:32434", "https://vulners.com/securityvulns/securityvulns:doc:32144", "https://vulners.com/securityvulns/securityvulns:doc:32431", "https://vulners.com/securityvulns/securityvulns:doc:32507", "https://vulners.com/securityvulns/securityvulns:doc:31969", "https://vulners.com/securityvulns/securityvulns:doc:31975", "https://vulners.com/securityvulns/securityvulns:doc:32142", "https://vulners.com/securityvulns/securityvulns:doc:32432", "https://vulners.com/securityvulns/securityvulns:doc:32141", "https://vulners.com/securityvulns/securityvulns:doc:32010"], "cvelist": ["CVE-2015-1835", "CVE-2015-5204"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:00", "history": [], "edition": 1, "hashmap": [{"key": "affectedSoftware", "hash": "cf24db8290f1cd9f1dda5905319a86cd"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "55f51d51aecea72e8cd28967b252d8fc"}, {"key": "cvss", "hash": "6e9bdd2021503689a2ad9254c9cdf2b3"}, {"key": "description", "hash": "8acb9077734f5c5e04c1ed77ca9f6edb"}, {"key": "href", "hash": "0c16440d2cb4f91efda1b714fef0f4cd"}, {"key": "modified", "hash": "5dd2f3be85ed2e74748ab8e08f63f7ea"}, {"key": "published", "hash": "5dd2f3be85ed2e74748ab8e08f63f7ea"}, {"key": "references", "hash": "512bf49facbdb78d43f2a4f8f0971178"}, {"key": "reporter", "hash": "7215ee9c7d9dc229d2921a40e899ec5f"}, {"key": "title", "hash": "c4db1a17d362234ffca6fff81f151f94"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "c9de2579ba0fa2df4d797718095c0625a2bf794f3c49e6802d00e10d262200b6", "viewCount": 4, "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2018-08-31T11:10:00"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2015-5204", "CVE-2015-1835"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:32144", "SECURITYVULNS:DOC:32591"]}, {"type": "jvn", "idList": ["JVN:21612597"]}], "modified": "2018-08-31T11:10:00"}, "vulnersScore": 7.5}, "objectVersion": "1.3", "affectedSoftware": [{"name": "Album Streamer", "operator": "eq", "version": "2.0"}, {"name": "SecureAnywhere Business Mobile Protection", "operator": "eq", "version": "1.10"}, {"name": "iPasswordManager", "operator": "eq", "version": "2.6"}, {"name": "Eisbar SCADA", "operator": "eq", "version": "2.1"}, {"name": "Wireless File Transfer Pro", "operator": "eq", "version": "5.9"}, {"name": "Mobile Drive HD", "operator": "eq", "version": "1.8"}, {"name": "UDID", "operator": "eq", "version": "1.0"}, {"name": "Photos in Wifi", "operator": "eq", "version": "1.0"}, {"name": "GRINDR", "operator": "eq", "version": "2.1"}, {"name": "GRINDR", "operator": "eq", "version": "2.1"}, {"name": "Wireless Photo Transfer", "operator": "eq", "version": "3.0"}, {"name": "My.WiFi USB Drive", "operator": "eq", "version": "1.0"}, {"name": "HiDisk", "operator": "eq", "version": "2.4"}, {"name": "iClassSchedule", "operator": "eq", "version": "1.6"}, {"name": "Air Drive Plus", "operator": "eq", "version": "2.4"}, {"name": "Cordova Android File Transfer Plugin", "operator": "eq", "version": "1.2"}, {"name": "PhotoWebsite", "operator": "eq", "version": "3.1"}, {"name": "Avira Mobile Security", "operator": "eq", "version": "1.5"}, {"name": "OYO File Manager", "operator": "eq", "version": "1.1"}, {"name": "WiFi Drive CR", "operator": "eq", "version": "1.0"}, {"name": "vPhoto-Album", "operator": "eq", "version": "4.2"}, {"name": "WiFi Drive Pro", "operator": "eq", "version": "1.2"}, {"name": "Cordova", "operator": "eq", "version": "4.0"}, {"name": "Device Inspector", "operator": "eq", "version": "1.5"}, {"name": "SevDesk", "operator": "eq", "version": "1.1"}, {"name": "Photo Manager Pro", "operator": "eq", "version": "4.4"}]}

{"cve": [{"lastseen": "2016-09-03T22:50:32", "bulletinFamily": "NVD", "description": "CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows remote attackers to inject arbitrary headers via CRLF sequences in the filename of an uploaded file.", "modified": "2015-12-18T13:04:49", "published": "2015-12-17T14:59:01", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5204", "id": "CVE-2015-5204", "title": "CVE-2015-5204", "type": "cve", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-11-17T11:26:43", "bulletinFamily": "NVD", "description": "Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.", "modified": "2017-11-16T13:45:12", "published": "2017-10-27T15:29:00", "id": "CVE-2015-1835", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1835", "type": "cve", "title": "CVE-2015-1835", "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:59", "bulletinFamily": "software", "description": "\r\n\r\n-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA256\r\n\r\nCVE-2015-1835: Remote exploit of secondary configuration variables in \r\n Apache Cordova on Android\r\n\r\nSeverity: High\r\n\r\nVendor: The Apache Software Foundation\r\n\r\nVersions Affected:\r\n Cordova Android up to 4.0.1 (3.7.2 excluded)\r\n\r\nDescription:\r\n\r\nAndroid applications built with the Cordova framework that don't have \r\nexplicit values set in Config.xml can have undefined configuration \r\nvariables set by Intent. This can cause unwanted dialogs appearing \r\nin applications and changes in the application behaviour that can \r\ninclude the app force-closing.\r\n\r\nThe latest release of Cordova Android entirely removes the ability \r\nof configuration parameters to be set by intents. This change is \r\nan API change in the platform, and third-party plugins that use \r\nvalues set in the config.xml should make sure that they use the \r\npreferences API instead of relying on the Intent bundle, whcih \r\ncan be manipulated in this case.\r\n\r\nUpgrade path:\r\n\r\nDevelopers who are concerned about this should rebuild their \r\napplications with either Cordova Android 4.0.2, or Cordova 3.7.4 \r\nif they are unable to upgrade to Cordova 4.0.2. Developers should \r\nalso make sure that variables that they wish to have protected \r\nare specified in their config.xml.\r\n\r\nCredit:\r\n\r\nThis issue was discovered by Seven Shen of Trend Micro Mobile Threat Research Team\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: GnuPG/MacGPG2 v2.0\r\nComment: This message is encrypted and/or signed with PGP (gnu-pg, gpg). Contact dirkx@webweaving.org if you cannot read it.\r\n\r\niQCVAwUBVWbyfDGmPZbsFAuBAQim5gP8C/3m6DPI4YljLINtgtXgK+NOI2InjBPI\r\nMA0bb10da+XUCLrcHoJnMHdBL2aGhltnKapNjp4I4gph0QIkhlhIUXelHojPSjRH\r\n3ectaNsFCTJHofHKiMROtH3Fb5Gqo5U7LPtduvjCE4q/rJB/9LOHIojwWw/VqQo3\r\neBPdk/6bSaw=\r\n=ax4a\r\n-----END PGP SIGNATURE-----\r\n\r\n", "modified": "2015-06-01T00:00:00", "published": "2015-06-01T00:00:00", "id": "SECURITYVULNS:DOC:32144", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32144", "title": "CVE-2015-1835: ...", "type": "securityvulns", "cvss": {"score": 2.6, "vector": "AV:NETWORK/AC:HIGH/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-08-31T11:11:02", "bulletinFamily": "software", "description": "\r\n\r\nCVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File\r\nTransfer Plugin for Android\r\n\r\nSeverity:\r\n Medium\r\n\r\nVendor:\r\n The Apache Software Foundation\r\n\r\nVersions Affected:\r\n Cordova Android File Transfer Plugin (1.2.1 and below)\r\n\r\nDescription:\r\n Android applications built with the Cordova framework that use the File\r\n Transfer Plugin can have the HTTP headers set by that plugin be manipulated\r\n by the filename being uploaded. This allows for for cookies to be forged\r\n by the Cordova application, or for the file payload to be replaced in some\r\n situations. Remotely hosted applications and applications developed with\r\n Cordova that allow the user to manually enter the filename are\r\n especially vulnerable to this issue.\r\n\r\nUpgrade path:\r\n Developers who are concerned about this issue should install version 1.3.0\r\n or higher of the Cordova File Transfer Plugin and rebuild their\r\n applications. This plugin now conforms with RFC-2616 and no longer allows\r\n non-ASCII characters and control characters in header names or values.\r\n Any non-ASCII characters will be removed from the header. Developers\r\nshould be aware,\r\n and encode these characters before adding the values to the header.\r\n\r\nCredit:\r\n This issue was discovered by Muneaki Nishimura (Sony Digital Network\r\nApplications, Inc.)\r\n\r\n", "modified": "2015-10-25T00:00:00", "published": "2015-10-25T00:00:00", "id": "SECURITYVULNS:DOC:32591", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:32591", "title": "Re: CVE-2015-5204: HTTP header injection vulnerability in Apache Cordova File Transfer Plugin for Android", "type": "securityvulns", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "jvn": [{"lastseen": "2018-08-31T00:36:14", "bulletinFamily": "info", "description": "\n ## Description\n\ncordova-plugin-file-transfer, a plugin for Apache Cordova provided by the Apache Software Foundation, provides functionality to upload and download files in applications created by Apache Cordova. It also provides functionality to add HTTP headers. \nAndroid applications that use cordova-plugin-file-transfer contain a HTTP header injection vulnerability due to a flaw in processing file names.\n\n ## Impact\n\nFile name inclusion in additional HTTP headers may result in a forged webpage to be displayed on the user's web browser, arbitrary script execution, or setting arbitrary values for cookies.\n\n ## Solution\n\n**Update the plugin and rebuild the application** \nUpdate cordova-plugin-file-transfer to 1.3.0 or above versions and rebuild the application. \nAccording to the developer, the updated version is compliant with RFC2616, therefore any non-ASCII characters and control characters will be deleted when adding HTTP headers. \n \nFor more information, please refer to the information provided by the developer.\n\n ## Products Affected\n\n * cordova-plugin-file-transfer 1.2.1 and earlier versions\n", "modified": "2015-09-29T00:00:00", "published": "2015-09-29T00:00:00", "id": "JVN:21612597", "href": "http://jvn.jp/en/jp/JVN21612597/index.html", "title": "JVN#21612597: Apache Cordova plugin cordova-plugin-file-transfer vulnerable to HTTP header injection", "type": "jvn", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}