CO
Product
Cordova
On CISA KEVExploited in the wild
18
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 4Medium 3Low 1
Watch
Add Cordova to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21315 In wildKEV | 7.8 | Feb 16 | Command Injection Vulnerability Affected: 10.0.0 |
| CVE-2014-0073 | 9.8 | Oct 30 | The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from… Affected: 2.6.0 through 2.9.0 |
| CVE-2014-0072 | 7.5 | Oct 30 | ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from… Affected: 2.4.0 through 2.9.0 |
| CVE-2016-6799 | 7.5 | May 9 | Product: Apache Cordova Android 5.2.2 and earlier Affected: through 5.2.2 |
| CVE-2017-3160 | 7.4 | Feb 1 | After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch Gradle on the first build Affected: before 6.1.2 |
| CVE-2015-1835 | 5.3 | Oct 27 | Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary… Affected: through 3.7.1; 4.0.0; 4.0.1 |
| CVE-2015-5207 | 5.3 | May 9 | Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods Affected: through 3.9.1 |
| CVE-2015-5208 | 4.4 | May 9 | Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link Affected: through 3.9.1 |
| CVE-2020-11990 | 3.3 | Dec 1 | We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications Affected: 4.1.0 |
| CVE-2015-8320 | – | Nov 23 | Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting… Affected: through 3.6.4 |
| CVE-2015-5256 | – | Nov 23 | Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection mechanism, which allows attackers to… Affected: through 3.6.4 |
| CVE-2014-3502 | – | Nov 15 | Apache Cordova Android before 3.5.1 allows remote attackers to open and send data to arbitrary applications via a URL with a crafted URI scheme for an Android intent Affected: 3.5.0 |
| CVE-2014-3501 | – | Nov 15 | Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScript to open WebSocket connections through… Affected: 3.5.0 |
| CVE-2014-3500 | – | Nov 15 | Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL Affected: through 3.5.0 |
| CVE-2014-1884 | – | Mar 3 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass… Affected: through 3.3.0; 3.0.0; 3.0.0; 3.1.0; 3.1.0; 3.2.0; +2 more |
| CVE-2014-1882 | – | Mar 3 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted… Affected: through 3.3.0; 3.0.0; 3.0.0; 3.1.0; 3.1.0; 3.2.0; +2 more |
| CVE-2014-1881 | – | Mar 3 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted… Affected: through 3.3.0; 3.0.0; 3.0.0; 3.1.0; 3.1.0; 3.2.0; +2 more |
| CVE-2012-6637 | – | Mar 3 | Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist… Affected: through 3.3.0; 3.0.0; 3.0.0; 3.1.0; 3.1.0; 3.2.0; +2 more |
Showing 18