heinekingmedia StashCat vulnerabilities
4 known CVE vulnerabilities in heinekingmedia StashCat, translated and rated.
- CVE-2017-11133High
An issue exists in heinekingmedia StashCat regarding the generation of encryption keys for messages. The use of AES in CBC mode with a pseudo-random secret generated by math.random() does not provide adequate security.
- CVE-2017-11132High
An issue was discovered in heinekingmedia StashCat before version 1.5.18 for Android related to the lack of certificate pinning. As a result, an attacker could issue a certificate for the backend, and the application would not notice it.
- CVE-2017-11130High
An issue was discovered in heinekingmedia StashCat related to the lack of integrity and authenticity checks in the protocol. Affected versions are 1.7.5 for Android, 0.0.80w for Web, and 0.0.86 for Desktop.
- CVE-2017-11129Critical
An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android related to key storage. The keystore is locked with a hard-coded password, allowing anyone with access to read its contents, including the user's private key.