Apache Cordova File Transfer vulnerabilities

2 known vulnerabilities affecting apache/cordova_file_transfer.

Total CVEs

2

CISA KEV

0

Public exploits

0

Exploited in wild

0

Severity breakdown

HIGH1MEDIUM1

Vulnerabilities

Page 1 of 1

CVE-2014-0072HIGHCVSS 7.5≤ 0.4.12017-10-30

CVE-2014-0072 [HIGH] CWE-20 CVE-2014-0072: ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.

CVE-2015-5204MEDIUMCVSS 4.3≤ 1.2.12015-12-17

CVE-2015-5204 [MEDIUM] CVE-2015-5204: CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfe CRLF injection vulnerability in the Apache Cordova File Transfer Plugin (cordova-plugin-file-transfer) for Android before 1.3.0 allows remote attackers to inject arbitrary headers via CRLF sequences in the filename of an uploaded file.