Cordova (Apache) - vulnerabilities (CVEs)

18 CVEs, 0 in the last 30 days, 188 known versions, newest CVE from 2021-02-16. Vendor: Apache.

CVEs of Cordova

CVE-2021-21315 - CVSS 7.8 (high), 2021-02-16: The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system…
CVE-2020-11990 - CVSS 3.3 (low), 2020-12-01: We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead…
CVE-2019-0219 - CVSS 9.8 (critical), 2020-01-14: A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted…
CVE-2017-3160 - CVSS 7.4 (high), 2018-02-01: After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the…
CVE-2014-0073 - CVSS 9.8 (critical), 2017-10-30: The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser…
CVE-2014-0072 - CVSS 7.5 (high), 2017-10-30: ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer…
CVE-2015-1835 - CVSS 5.3 (medium), 2017-10-27: Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify…
CVE-2016-6799 - CVSS 7.5 (high), 2017-05-09: Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(),…
CVE-2015-5208 - CVSS 4.4 (medium), 2016-05-09: Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.
CVE-2015-5207 - CVSS 5.3 (medium), 2016-05-09: Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging…
CVE-2015-8320 - CVSS 5 (medium), 2015-11-23: Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking…
CVE-2015-5256 - CVSS 4.3 (medium), 2015-11-23: Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which…
CVE-2014-3502 - CVSS 4.3 (medium), 2014-11-15: Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android…
CVE-2014-3501 - CVSS 4.3 (medium), 2014-11-15: Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open…
CVE-2014-3500 - CVSS 6.4 (medium), 2014-11-15: Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.
CVE-2014-1882 - CVSS 7.5 (high), 2014-03-03: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based…
CVE-2014-1881 - CVSS 7.5 (high), 2014-03-03: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based…
CVE-2012-6637 - CVSS 7.5 (high), 2014-03-03: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers…
CVE-2014-1884 - CVSS 7.5 (high), 2014-03-03: Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote…