CVE-2014-0073

The CDVInAppBrowser class in the Apache Cordova In-App-Browser standalone plugin (org.apache.cordova.inappbrowser) before 0.3.2 for iOS and the In-App-Browser plugin for iOS from Cordova 2.6.0 through 2.9.0 does not properly validate callback identifiers, which allows remote attackers to execute arbitrary JavaScript in the host page and consequently gain privileges via a crafted gap-iab: URI.

• CWE-264

• http://d3adend.org/blog/?p=403Issue Tracking, Third Party Advisory
• http://seclists.org/fulldisclosure/2014/Mar/30Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/531334/100/0/threaded
• http://www.securityfocus.com/bid/65959Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91560Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55Issue Tracking, Patch, Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E
• http://d3adend.org/blog/?p=403Issue Tracking, Third Party Advisory
• http://seclists.org/fulldisclosure/2014/Mar/30Mailing List, Third Party Advisory
• http://www.securityfocus.com/archive/1/531334/100/0/threaded
• http://www.securityfocus.com/bid/65959Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91560Issue Tracking, Third Party Advisory, VDB Entry
• https://github.com/apache/cordova-plugin-inappbrowser/commit/26702cb0720c5c394b407c23570136c53171fa55Issue Tracking, Patch, Vendor Advisory
• https://mail-archives.apache.org/mod_mbox/cordova-dev/201403.mbox/%3CCAK_TSXLGJag5Q9ATUCbFtkWvMWX9XnC80kKp-HKi25gPcvV4gw%40mail.gmail.com%3E

Published

Oct 30, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0067The "make check" command for the test suites in PostgreSQL 9…
• CVE-2014-0068It was reported that watchman in openshift node-utils create…5.5
• CVE-2014-0069The cifs_iovec_write function in fs/cifs/file.c in the Linux…
• CVE-2014-0070Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0071PackStack in Red Hat OpenStack 4.0 does not enforce the defa…
• CVE-2014-0072ios/CDVFileTransfer.m in the Apache Cordova File-Transfer st…
• CVE-2014-0074Apache Shiro 1.x before 1.2.3, when using an LDAP server wit…
• CVE-2014-0075Integer overflow in the parseChunkHeader function in java/or…
• CVE-2014-0076The Montgomery ladder implementation in OpenSSL through 1.0.…
• CVE-2014-0077drivers/vhost/net.c in the Linux kernel before 3.13.10, when…
• CVE-2014-0078The CatalogController in Red Hat CloudForms Management Engin…
• CVE-2014-0079The ValidateUserLogon function in provider/libserver/ECSessi…