CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3501
https://notcve.org/view.php?id=CVE-2014-3501
Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through WebView. Apache Cordova Android anterior a 3.5.1 permite a atacantes remotos saltar la whitelist de HTTP y conectarse a servidores arbitrarios usando JavaScript para abrir las conexiones de WebSocket a través de WebView. • http://cordova.apache.org/announcements/2014/08/04/android-351.html http://www.securityfocus.com/bid/69041 • CWE-254: 7PK - Security Features •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-0072
https://notcve.org/view.php?id=CVE-2014-0072
ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option. ios/CDVFileTransfer.m en el plugin independiente Apache Cordova File-Transfer (org.apache.cordova.file-transfer) en versiones anteriores a la 0.4.2 para iOS y el plugin File-Transfer para iOS de Cordova desde la versión 2.4.0 hasta la 2.9.0 podría permitir que atacantes remotos suplanten servidores SSL aprovechando un valor true por defecto para la opción trustAllHosts. • http://d3adend.org/blog/?p=403 http://seclists.org/fulldisclosure/2014/Mar/29 http://www.securityfocus.com/archive/1/531335/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/91561 https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668 https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2014-0073
https://notcve.org/view.php?id=CVE-2014-0073
The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI. La clase CDVInAppBrowser en el plugin independiente Apache Cordova In-App-Browser (org.apache.cordova.inappbrowser) en versiones anteriores a la 0.3.2 para iOS y el plugin In-App-Browser para iOS de Cordova desde la versión 2.6.0 hasta la 2.9.0 no valida correctamente los identificadores de devolución de llamada. Esto permite que atacantes remotos ejecuten código JavaScript arbitrario en la página del host y, consecuentemente, obtengan privilegios mediante un URI gap-iab: manipulado. • http://d3adend.org/blog/?p=403 http://seclists.org/fulldisclosure/2014/Mar/30 http://www.securityfocus.com/archive/1/531334/100/0/threaded http://www.securityfocus.com/bid/65959 https://exchange.xforce.ibmcloud.com/vulnerabilities/91560 https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55 https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 1%CPEs: 29EXPL: 1CVE-2014-1881
https://notcve.org/view.php?id=CVE-2014-1881
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and waits a certain amount of time for an OnJsPrompt handler return value as an alternative to correct synchronization. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores permiten a atacantes remotos evadir restricciones "device-resource" de un puente basado en eventos a través de un clon de libraría manipulada que aprovecha la ejecución de script IFRAME y espera una cierta cantidad de tiempo para un valor de vuelta del manejador OnJsPrompt como alternativa a la sincronización correcta. • http://openwall.com/lists/oss-security/2014/02/07/9 http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt http://seclists.org/bugtraq/2014/Jan/96 http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf http://www.internetsociety.org/ndss2014/programme#session3 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 2%CPEs: 29EXPL: 0CVE-2014-1882
https://notcve.org/view.php?id=CVE-2014-1882
Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that leverages IFRAME script execution and directly accesses bridge JavaScript objects, as demonstrated by certain cordova.require calls. Apache Cordova 3.3.0 y anteriores y Adobe PhoneGap 2.9.0 y anteriores permiten a atacantes remotos evadir restricciones "device-resource" de un puente basado en eventos a través de un clon de librería manipulada que aprovecha la ejecución de script IFRAME y acceda directamente objetos JavaScript puente, tal y como se demostró con ciertas llamadas cordova.require. • http://openwall.com/lists/oss-security/2014/02/07/9 http://packetstormsecurity.com/files/124954/apachecordovaphonegap-bypass.txt http://seclists.org/bugtraq/2014/Jan/96 http://www.cs.utexas.edu/~shmat/shmat_ndss14nofrak.pdf http://www.internetsociety.org/ndss2014/programme#session3 • CWE-264: Permissions, Privileges, and Access Controls •