Adobe Phonegap vulnerabilities

5 CVEs affecting Adobe Phonegap, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-1884, published 2014-03-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-1882, published 2014-03-03. High severity, CVSS 7.5. EPSS: 11.9% chance of exploitation in the next 30 days. Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that…
CVE-2014-1881, published 2014-03-03. High severity, CVSS 7.5. EPSS: 11.4% chance of exploitation in the next 30 days. Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier allow remote attackers to bypass intended device-resource restrictions of an event-based bridge via a crafted library clone that…
CVE-2012-6637, published 2014-03-03. High severity, CVSS 7.5. EPSS: 8.9% chance of exploitation in the next 30 days. Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier do not anchor the end of domain-name regular expressions, which allows remote attackers to bypass a whitelist protection…
CVE-2014-1884, published 2014-03-03. High severity, CVSS 7.5. EPSS: 8.2% chance of exploitation in the next 30 days. Apache Cordova 3.3.0 and earlier and Adobe PhoneGap 2.9.0 and earlier on Windows Phone 7 and 8 do not properly restrict navigation events, which allows remote attackers to bypass intended…
CVE-2014-1883, published 2014-03-03. High severity, CVSS 7.5. EPSS: 4.2% chance of exploitation in the next 30 days. Adobe PhoneGap before 2.6.0 on Android uses the shouldOverrideUrlLoading callback instead of the proper shouldInterceptRequest callback, which allows remote attackers to bypass intended…