Apache Cordova
19 CVEs affecting Apache Cordova. Latest disclosed: 2021-02-16. Critical: 2, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-0219 | Critical | 9.8 | 2020-01-14 | A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab… |
CVE-2014-0073 | Critical | 9.8 | 2017-10-30 | The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser… |
CVE-2014-0072 | High | 7.5 | 2017-10-30 | ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugi… |
CVE-2016-6799 | High | 7.5 | 2017-05-09 | Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i()… |
CVE-2017-3160 | High | 7.4 | 2018-02-01 | After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the firs… |
CVE-2021-21315 | High | 7.1 | 2021-02-16 | The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system an… |
CVE-2015-1835 | Medium | 5.3 | 2017-10-27 | Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify und… |
CVE-2015-5207 | Medium | 5.3 | 2016-05-09 | Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspe… |
CVE-2015-5208 | Medium | 4.4 | 2016-05-09 | Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link. |
CVE-2020-11990 | Low | 3.3 | 2020-12-01 | We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications. An attacker who could install (or lead… |
CVE-2015-8320 | | 2015-11-23 | Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking a… | |
CVE-2015-5256 | | 2015-11-23 | Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which al… | |
CVE-2014-3502 | | 2014-11-15 | Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android… | |
CVE-2014-3501 | | 2014-11-15 | Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket… | |
CVE-2014-3500 | | 2014-11-15 | Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL. | |
CVE-2014-1884 | | 2014-03-03 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote… | |
CVE-2014-1882 | | 2014-03-03 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based… | |
CVE-2014-1881 | | 2014-03-03 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based… | |
CVE-2012-6637 | | 2014-03-03 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers t… |