CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 1CVE-2015-1835
https://notcve.org/view.php?id=CVE-2015-1835
Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL. Apache Cordova Android en versiones anteriores a la 3.7.2 y versiones 4.x anteriores a la 4.0.2, cuando una aplicación no establece valores explícitos en config.xml, permite que atacantes remotos modifiquen variables de configuración secundarias no definidas (preferencias) mediante una URL intent: manipulada. • http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-apache-vulnerability-that-allows-one-click-modification-of-android-apps http://www.securityfocus.com/bid/74866 https://cordova.apache.org/announcements/2015/05/26/android-402.html • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3501
https://notcve.org/view.php?id=CVE-2014-3501
Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView. Apache Cordova Android anterior a 3.5.1 permite a atacantes remotos saltar la whitelist de HTTP y conectarse a servidores arbitrarios usando JavaScript para abrir las conexiones de WebSocket a través de WebView. • http://cordova.apache.org/announcements/2014/08/04/android-351.html http://www.securityfocus.com/bid/69041 • CWE-254: 7PK - Security Features •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3502
https://notcve.org/view.php?id=CVE-2014-3502
Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent. Apache Cordova Android anterior a 3.5.1 permite a atacantes remotos abrir y enviar datos a aplicaciones arbitrarias a través una URL con un esquema URI manipulado para un intento Android. • http://cordova.apache.org/announcements/2014/08/04/android-351.html http://cordova.apache.org/announcements/2014/08/06/android-351-update.html http://www.securityfocus.com/bid/69046 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3500
https://notcve.org/view.php?id=CVE-2014-3500
Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL. Vulnerabilidad en la aplicación Apache Cordova para Android en versiones inferiores a la 3.5.1 permite a atacantes remotos cambiar la página de inicio a través de URL manipuladas. • http://cordova.apache.org/announcements/2014/08/04/android-351.html http://www.securityfocus.com/bid/69038 • CWE-17: DEPRECATED: Code •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-0072
https://notcve.org/view.php?id=CVE-2014-0072
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option. ios/CDVFileTransfer.m en el plugin independiente Apache Cordova File-Transfer (org.apache.cordova.file-transfer) en versiones anteriores a la 0.4.2 para iOS y el plugin File-Transfer para iOS de Cordova desde la versión 2.4.0 hasta la 2.9.0 podría permitir que atacantes remotos suplanten servidores SSL aprovechando un valor true por defecto para la opción trustAllHosts. • http://d3adend.org/blog/?p=403 http://seclists.org/fulldisclosure/2014/Mar/29 http://www.securityfocus.com/archive/1/531335/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/91561 https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668 https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E • CWE-20: Improper Input Validation •