Karsten König

The issue is related to an out-of-bounds access problem that has been addressed with improved bounds checking. Processing a maliciously crafted file may lead to unexpected app termination. It is also described as a potential data exposure risk due to an out-of-bounds read vulnerability in the File Handler component.

An out-of-bounds write issue was addressed with improved input validation. Processing a maliciously crafted video file may lead to unexpected app termination.

The issue was addressed with improved memory handling. Processing a file may lead to unexpected app termination or arbitrary code execution.

An out-of-bounds write issue was addressed with improved input validation. Processing a file may lead to unexpected app termination or arbitrary code execution.

The issue was addressed with improved memory handling. Processing a file may lead to a denial-of-service or potentially disclose memory contents.

The issue was addressed with improved memory handling. Processing a file may lead to a denial-of-service or potentially disclose memory contents.

An out-of-bounds read issue was addressed with improved input validation. Processing an image may lead to arbitrary code execution.

The issue was addressed with improved memory handling. An app may be able to execute arbitrary code with kernel privileges.

The issue is related to a buffer overflow in the ImageIO component of Apple operating systems, which can be exploited by a remote attacker using a specially crafted image file, potentially leading to arbitrary code execution. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to a stack-based buffer over-read in the `file copystr` function in `funcs.c`, which can lead to a denial of service when a specially crafted file is used. This can be exploited by an attacker to cause service disruption.

An issue was discovered in the encryption process of heinekingmedia StashCat. The software uses AES in CBC mode to encrypt messages with a pseudo-random secret. However, the secret and the IV are generated using methods that are not cryptographically strong, specifically math.random() in previous versions and CryptoJS.lib.WordArray.random() in newer versions, which internally uses math.random().

An issue was discovered where no certificate pinning is implemented, allowing an attacker to issue a certificate for the backend without the application noticing it.

The issue concerns the authentication mechanism, where user passwords are hashed directly with SHA-512 without a salt or another key-derivation mechanism. Only the first 32 bytes of the hash are used, making it vulnerable to dictionary and rainbow-table attacks if an attacker gains access to the password hash.

An issue was discovered where the keystore is locked with a hard-coded password, allowing anyone with access to the keystore to read its content, including the user's private key.

An issue allows login credentials to be written into a log file on the device. As a result, an attacker with access to the logs can read these credentials.

The logout mechanism in the affected software does not properly check for authorization, allowing an attacker to exploit this issue by only needing to know the device ID. This results in a denial of service. The problem stems from the client side's inability to securely signal the end of a session and request data deletion.

The issue concerns the use of RSA for exchanging a secret for symmetric encryption of messages. However, the private RSA key is stored on the client and also transmitted to the backend. The key to decrypt the private key is composed of the first 32 bytes of the SHA-512 hash of the `user password`. This hash is also stored on the backend, allowing anyone with access to the backend database to read the transmitted secret for symmetric encryption and thus access the communication.

The issue concerns the product's protocol, which only ensures confidentiality but lacks integrity and authenticity checks. This allows man-in-the-middle attackers to conduct replay attacks.