CVE-2014-0072

ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Transfer plugin for iOS from Cordova 2.4.0 through 2.9.0 might allow remote attackers to spoof SSL servers by leveraging a default value of true for the trustAllHosts option.

• CWE-20

• http://d3adend.org/blog/?p=403Issue Tracking, Third Party Advisory
• http://seclists.org/fulldisclosure/2014/Mar/29Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/531335/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91561Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668Issue Tracking, Patch, Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E
• http://d3adend.org/blog/?p=403Issue Tracking, Third Party Advisory
• http://seclists.org/fulldisclosure/2014/Mar/29Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/531335/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91561Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/apache/cordova-plugin-file-transfer/commit/a1d6fc07e8a40c1b2b16f4103c403b30e1089668Issue Tracking, Patch, Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXKL9JtkehHC0jEoRwdvVKXt-d5uj40EwNY-Gk3ttX=wJw%40mail.gmail.com%3E

Published

Oct 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0066The chkpass extension in PostgreSQL before 8.4.20, 9.0.x bef…
• CVE-2014-0067The "make check" command for the test suites in PostgreSQL 9…
• CVE-2014-0068It was reported that watchman in openshift node-utils create…5.5
• CVE-2014-0069The cifs_iovec_write function in fs/cifs/file.c in the Linux…
• CVE-2014-0070Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0071PackStack in Red Hat OpenStack 4.0 does not enforce the defa…
• CVE-2014-0073The CDVInAppBrowser class in the Apache Cordova In-App-Brows…
• CVE-2014-0074Apache Shiro 1.x before 1.2.3, when using an LDAP server wit…
• CVE-2014-0075Integer overflow in the parseChunkHeader function in java/or…
• CVE-2014-0076The Montgomery ladder implementation in OpenSSL through 1.0.…
• CVE-2014-0077drivers/vhost/net.c in the Linux kernel before 3.13.10, when…
• CVE-2014-0078The CatalogController in Red Hat CloudForms Management Engin…