- Synchronized data.

This commit is contained in:
CVE Team 2018-07-06 17:06:14 -04:00
parent 6a69c5e49a
commit 6de2a2712b
No known key found for this signature in database
GPG Key ID: 0DA1F9F56BC892E8
4 changed files with 196 additions and 196 deletions

View File

@ -1,89 +1,89 @@
{
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-6538",
"STATE": "PUBLIC",
"TITLE": "TrackR Bravo mobile application stores account passwords in cleartext"
"CVE_data_meta" : {
"ASSIGNER" : "cert@cert.org",
"ID" : "CVE-2016-6538",
"STATE" : "PUBLIC",
"TITLE" : "TrackR Bravo mobile application stores account passwords in cleartext"
},
"affects": {
"vendor": {
"vendor_data": [
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product": {
"product_data": [
"product" : {
"product_data" : [
{
"product_name": "Bravo Mobile Application",
"version": {
"version_data": [
"product_name" : "Bravo Mobile Application",
"version" : {
"version_data" : [
{
"affected": "!",
"platform": "iOS",
"version_value": "5.1.6"
"affected" : "!",
"platform" : "iOS",
"version_value" : "5.1.6"
},
{
"affected": "!",
"platform": "Android",
"version_value": "2.2.5"
"affected" : "!",
"platform" : "Android",
"version_value" : "2.2.5"
}
]
}
}
]
},
"vendor_name": "TrackR"
"vendor_name" : "TrackR"
}
]
}
},
"credit": [
"credit" : [
{
"lang": "eng",
"value": "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
"lang" : "eng",
"value" : "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang": "eng",
"value": "The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
"lang" : "eng",
"value" : "The TrackR Bravo mobile app stores the account password used to authenticate to the cloud API in cleartext in the cache.db file. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
}
]
},
"problemtype": {
"problemtype_data": [
"problemtype" : {
"problemtype_data" : [
{
"description": [
"description" : [
{
"lang": "eng",
"value": "CWE-313: Cleartext Storage in a File or on Disk"
"lang" : "eng",
"value" : "CWE-313: Cleartext Storage in a File or on Disk"
}
]
}
]
},
"references": {
"reference_data": [
"references" : {
"reference_data" : [
{
"name": "VU#617567",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/617567"
"name" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource" : "MISC",
"url" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
},
{
"name": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource": "MISC",
"url": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
"name" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource" : "MISC",
"url" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
},
{
"name": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
"name" : "VU#617567",
"refsource" : "CERT-VN",
"url" : "https://www.kb.cert.org/vuls/id/617567"
}
]
},
"source": {
"discovery": "UNKNOWN"
"source" : {
"discovery" : "UNKNOWN"
}
}
}

View File

@ -1,89 +1,89 @@
{
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-6539",
"STATE": "PUBLIC",
"TITLE": "TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID"
"CVE_data_meta" : {
"ASSIGNER" : "cert@cert.org",
"ID" : "CVE-2016-6539",
"STATE" : "PUBLIC",
"TITLE" : "TrackR Bravo MAC address can be exposed in close proximity and used to obtain the device ID"
},
"affects": {
"vendor": {
"vendor_data": [
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product": {
"product_data": [
"product" : {
"product_data" : [
{
"product_name": "Bravo Mobile Application",
"version": {
"version_data": [
"product_name" : "Bravo Mobile Application",
"version" : {
"version_data" : [
{
"affected": "!",
"platform": "iOS",
"version_value": "5.1.6"
"affected" : "!",
"platform" : "iOS",
"version_value" : "5.1.6"
},
{
"affected": "!",
"platform": "Android",
"version_value": "2.2.5"
"affected" : "!",
"platform" : "Android",
"version_value" : "2.2.5"
}
]
}
}
]
},
"vendor_name": "TrackR"
"vendor_name" : "TrackR"
}
]
}
},
"credit": [
"credit" : [
{
"lang": "eng",
"value": "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
"lang" : "eng",
"value" : "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang": "eng",
"value": "The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
"lang" : "eng",
"value" : "The Trackr device ID is constructed of a manufacturer identifier of four zeroes followed by the BLE MAC address in reverse. The MAC address can be obtained by being in close proximity to the Bluetooth device, effectively exposing the device ID. The ID can be used to track devices. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
}
]
},
"problemtype": {
"problemtype_data": [
"problemtype" : {
"problemtype_data" : [
{
"description": [
"description" : [
{
"lang": "eng",
"value": "CWE-200: Information Exposure"
"lang" : "eng",
"value" : "CWE-200: Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
"references" : {
"reference_data" : [
{
"name": "VU#617567",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/617567"
"name" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource" : "MISC",
"url" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
},
{
"name": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource": "MISC",
"url": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
"name" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource" : "MISC",
"url" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
},
{
"name": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
"name" : "VU#617567",
"refsource" : "CERT-VN",
"url" : "https://www.kb.cert.org/vuls/id/617567"
}
]
},
"source": {
"discovery": "UNKNOWN"
"source" : {
"discovery" : "UNKNOWN"
}
}
}

View File

@ -1,89 +1,89 @@
{
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-6540",
"STATE": "PUBLIC",
"TITLE": "TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users"
"CVE_data_meta" : {
"ASSIGNER" : "cert@cert.org",
"ID" : "CVE-2016-6540",
"STATE" : "PUBLIC",
"TITLE" : "TrackR Bravo is missing authentication for the cloud service and allows querying or sending of GPS data from unauthenticated users"
},
"affects": {
"vendor": {
"vendor_data": [
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product": {
"product_data": [
"product" : {
"product_data" : [
{
"product_name": "Bravo Mobile Application",
"version": {
"version_data": [
"product_name" : "Bravo Mobile Application",
"version" : {
"version_data" : [
{
"affected": "!",
"platform": "iOS",
"version_value": "5.1.6"
"affected" : "!",
"platform" : "iOS",
"version_value" : "5.1.6"
},
{
"affected": "!",
"platform": "Android",
"version_value": "2.2.5"
"affected" : "!",
"platform" : "Android",
"version_value" : "2.2.5"
}
]
}
}
]
},
"vendor_name": "TrackR"
"vendor_name" : "TrackR"
}
]
}
},
"credit": [
"credit" : [
{
"lang": "eng",
"value": "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
"lang" : "eng",
"value" : "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang": "eng",
"value": "Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
"lang" : "eng",
"value" : "Unauthenticated access to the cloud-based service maintained by TrackR Bravo is allowed for querying or sending GPS data for any Trackr device by using the tracker ID number which can be discovered as described in CVE-2016-6539. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
}
]
},
"problemtype": {
"problemtype_data": [
"problemtype" : {
"problemtype_data" : [
{
"description": [
"description" : [
{
"lang": "eng",
"value": "CWE-306: Missing Authentication for Critical Function"
"lang" : "eng",
"value" : "CWE-306: Missing Authentication for Critical Function"
}
]
}
]
},
"references": {
"reference_data": [
"references" : {
"reference_data" : [
{
"name": "VU#617567",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/617567"
"name" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource" : "MISC",
"url" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
},
{
"name": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource": "MISC",
"url": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
"name" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource" : "MISC",
"url" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
},
{
"name": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
"name" : "VU#617567",
"refsource" : "CERT-VN",
"url" : "https://www.kb.cert.org/vuls/id/617567"
}
]
},
"source": {
"discovery": "UNKNOWN"
"source" : {
"discovery" : "UNKNOWN"
}
}
}

View File

@ -1,89 +1,89 @@
{
"CVE_data_meta": {
"ASSIGNER": "cert@cert.org",
"ID": "CVE-2016-6541",
"STATE": "PUBLIC",
"TITLE": "TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes"
"CVE_data_meta" : {
"ASSIGNER" : "cert@cert.org",
"ID" : "CVE-2016-6541",
"STATE" : "PUBLIC",
"TITLE" : "TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes"
},
"affects": {
"vendor": {
"vendor_data": [
"affects" : {
"vendor" : {
"vendor_data" : [
{
"product": {
"product_data": [
"product" : {
"product_data" : [
{
"product_name": "Bravo Mobile Application",
"version": {
"version_data": [
"product_name" : "Bravo Mobile Application",
"version" : {
"version_data" : [
{
"affected": "!",
"platform": "iOS",
"version_value": "5.1.6"
"affected" : "!",
"platform" : "iOS",
"version_value" : "5.1.6"
},
{
"affected": "!",
"platform": "Android",
"version_value": "2.2.5"
"affected" : "!",
"platform" : "Android",
"version_value" : "2.2.5"
}
]
}
}
]
},
"vendor_name": "TrackR"
"vendor_name" : "TrackR"
}
]
}
},
"credit": [
"credit" : [
{
"lang": "eng",
"value": "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
"lang" : "eng",
"value" : "Thanks to Deral Heiland and Adam Compton of Rapid7, Inc. for reporting this vulnerability."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
"data_format" : "MITRE",
"data_type" : "CVE",
"data_version" : "4.0",
"description" : {
"description_data" : [
{
"lang": "eng",
"value": "TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
"lang" : "eng",
"value" : "TrackR Bravo device allows unauthenticated pairing, which enables unauthenticated connected applications to write to various device attributes. Updated apps, version 5.1.6 for iOS and 2.2.5 for Android, have been released by the vendor to address the vulnerabilities in CVE-2016-6538, CVE-2016-6539, CVE-2016-6540 and CVE-2016-6541."
}
]
},
"problemtype": {
"problemtype_data": [
"problemtype" : {
"problemtype_data" : [
{
"description": [
"description" : [
{
"lang": "eng",
"value": "CWE-306: Missing Authentication for Critical Function"
"lang" : "eng",
"value" : "CWE-306: Missing Authentication for Critical Function"
}
]
}
]
},
"references": {
"reference_data": [
"references" : {
"reference_data" : [
{
"name": "VU#617567",
"refsource": "CERT-VN",
"url": "https://www.kb.cert.org/vuls/id/617567"
"name" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource" : "MISC",
"url" : "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
},
{
"name": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/",
"refsource": "MISC",
"url": "https://blog.rapid7.com/2016/10/25/multiple-bluetooth-low-energy-ble-tracker-vulnerabilities/"
"name" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource" : "MISC",
"url" : "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
},
{
"name": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ",
"refsource": "MISC",
"url": "https://www.kb.cert.org/vuls/id/TNOY-AF3KCZ"
"name" : "VU#617567",
"refsource" : "CERT-VN",
"url" : "https://www.kb.cert.org/vuls/id/617567"
}
]
},
"source": {
"discovery": "UNKNOWN"
"source" : {
"discovery" : "UNKNOWN"
}
}
}