CVSS: 7.5EPSS: 2%CPEs: 33EXPL: 1CVE-2014-1884
https://notcve.org/view.php?id=CVE-2014-1884
03 Mar 2014 — Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended device-resource restrictions via content that is accessed (1) in an IFRAME element or (2) with the XMLHttpRequest method by a crafted application. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores en Windows Phone 7 y 8 no restringen debidamente eventos de navegación, lo que permite a atacantes remotos ... • http://openwall.com/lists/oss-security/2014/02/07/9 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 1CVE-2014-1887
https://notcve.org/view.php?id=CVE-2014-1887
03 Mar 2014 — The DrinkedIn BarFinder application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain sensitive fine-geolocation information, by leveraging control over one of a number of adult sites, as demonstrated by (1) freelifetimecheating.com and (2) www.babesroulette.com. La aplicación DrinkedIn BarFinder para Android, cuando Adobe PhoneGap 2.9.0 o anteriores es utilizado, permite a atacantes remotos ejecutar código JavaSc... • http://openwall.com/lists/oss-security/2014/02/07/9 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 7%CPEs: 29EXPL: 0CVE-2014-1882
https://notcve.org/view.php?id=CVE-2014-1882
03 Mar 2014 — Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores permiten a atacantes remotos evadir restricciones "device-resource" de un puente basado en eventos a través de... • http://openwall.com/lists/oss-security/2014/02/07/9 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 22EXPL: 0CVE-2014-1885
https://notcve.org/view.php?id=CVE-2014-1885
03 Mar 2014 — The ForzeArmate application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently obtain write access to external-storage resources, by leveraging control over any Google syndication advertising domain. La aplicación ForzeArmate para Android, cuando Adobe PhoneGap 2.9.0 o anteriores es utilizado, permite a atacantes remotos ejecutar código JavaScript arbitrario y como consecuencia obtener acceso de escritura a recursos de al... • http://openwall.com/lists/oss-security/2014/02/07/9 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 1%CPEs: 29EXPL: 1CVE-2014-1881
https://notcve.org/view.php?id=CVE-2014-1881
03 Mar 2014 — Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores permiten a atacantes remotos evadir restricciones "device-resource" de un puente basado e... • http://openwall.com/lists/oss-security/2014/02/07/9 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 29EXPL: 1CVE-2012-6637
https://notcve.org/view.php?id=CVE-2012-6637
03 Mar 2014 — Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection mechanism via a domain name that contains an acceptable name as an initial substring. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores no identifican las expresiones regulares del final de un nombre de dominio, lo que permite a atacantes remotos evadir un mecanismo de protección de lista blanca a tr... • http://labs.mwrinfosecurity.com/blog/2012/04/30/building-android-javajavascript-bridges • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 22EXPL: 1CVE-2014-1886
https://notcve.org/view.php?id=CVE-2014-1886
03 Mar 2014 — The Edinburgh by Bus application for Android, when Adobe PhoneGap 2.9.0 or earlier is used, allows remote attackers to execute arbitrary JavaScript code, and consequently access external-storage resources, by leveraging control over one of a number of "obscure Eastern European dating sites." La aplicación Edinburgh by Bus para Android, cuando Adobe PhoneGap 2.9.0 o anteriores es utilizado, permite a atacantes remotos ejecutar código JavaScript arbitrario, y como consecuencia acceder a recursos de almacenami... • http://openwall.com/lists/oss-security/2014/02/07/9 • CWE-264: Permissions, Privileges, and Access Controls •