CVE-2024-2365

A vulnerability classified as problematic was found in Musicshelf 1.0/1.1 on Android. Affected by this vulnerability is an unknown functionality of the file io\fabric\sdk\android\services\network\PinningTrustManager.java of the component SHA-1 Handler. The manipulation leads to password hash with insufficient computational effort. It is possible to launch the attack on the physical device. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-256321 was assigned to this vulnerability.

• CWE-916

• https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.mdExploit
• https://vuldb.com/?ctiid.256321Permissions Required
• https://vuldb.com/?id.256321Permissions Required
• https://github.com/ctflearner/Android_Findings/blob/main/Musicshelf/Weak_Hashing_Algorithms.mdExploit
• https://vuldb.com/?ctiid.256321Permissions Required
• https://vuldb.com/?id.256321Permissions Required

Published

Mar 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23644Trillium is a composable toolkit for building internet appli…8.1
• CVE-2024-23645GLPI is a Free Asset and IT Management Software package. A m…6.1
• CVE-2024-23646Pimcore's Admin Classic Bundle provides a backend user inter…8.8
• CVE-2024-23647Authentik is an open-source Identity Provider. There is a bu…8.8
• CVE-2024-23648Pimcore's Admin Classic Bundle provides a backend user inter…8.8
• CVE-2024-23649Lemmy is a link aggregator and forum for the fediverse. Star…6.5
• CVE-2024-23650BuildKit is a toolkit for converting source code to build ar…5.3
• CVE-2024-23651BuildKit is a toolkit for converting source code to build ar…7.4
• CVE-2024-23652BuildKit is a toolkit for converting source code to build ar…9.1
• CVE-2024-23653BuildKit is a toolkit for converting source code to build ar…9.8
• CVE-2024-23654discourse-ai is the AI plugin for the open-source discussion…7.2
• CVE-2024-23655Tuta is an encrypted email service. Starting in version 3.11…5.3