CVE-2017-11130

An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attackers can conduct replay attacks.

• CWE-345

• http://seclists.org/fulldisclosure/2017/Jul/90Mailing List, Third Party Advisory
• http://seclists.org/fulldisclosure/2017/Jul/90Mailing List, Third Party Advisory

Published

Aug 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-11125libxar.so in xar 1.6.1 has a NULL pointer dereference in the…
• CVE-2017-11126The III_i_stereo function in libmpg123/layer3.c in mpg123 th…
• CVE-2017-11127Bolt CMS 3.2.14 allows stored XSS by uploading an SVG docume…
• CVE-2017-11128Bolt CMS 3.2.14 allows stored XSS via text input, as demonst…
• CVE-2017-11129An issue was discovered in heinekingmedia StashCat through 1…
• CVE-2017-1113IBM Rational Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerab…
• CVE-2017-11131An issue was discovered in heinekingmedia StashCat through 1…
• CVE-2017-11132An issue was discovered in heinekingmedia StashCat before 1.…7.5
• CVE-2017-11133An issue was discovered in heinekingmedia StashCat through 1…
• CVE-2017-11134An issue was discovered in heinekingmedia StashCat through 1…
• CVE-2017-11135An issue was discovered in heinekingmedia StashCat through 1…
• CVE-2017-11136An issue was discovered in heinekingmedia StashCat through 1…