Vulnerabilidades do Meatmeet Meatmeet
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Meatmeet Meatmeet: 6 registro(s), com versões afetadas e correções.cpe:2.3:a:meatmeet:meatmeet
CVE-2025-65832
Média · 4.6
CWE-316 10/12/2025
The mobile application insecurely handles information stored within memory. By…
The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and terminated it, Wi-Fi credentials sent during the pairing process, JWTs used for authentication, and other sensitive details can be retrieved. As a result, an attacker with physical access to the device of a victim can retrieve this information and gain unauthorized access to their home Wi-Fi network and Meatmeet account.
CVE-2025-65831
Alta · 7.5
CWE-327 10/12/2025
Use of a Broken or Risky Cryptographic Algorithm em Meatmeet
The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through exploiting cloud services, performing TLS downgrade attacks on the traffic from a mobile device, or through another means, they may be able to crack the hash in a reasonable amount of time and gain unauthorized access to the victim's account.
CVE-2025-65830
Crítica · 9.1
CWE-295 10/12/2025
Improper Certificate Validation em Meatmeet
Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt the TLS traffic, inspect its contents, and modify the requests in transit. This may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.
CVE-2025-65827
Crítica · 9.1
CWE-319 10/12/2025
Cleartext Transmission of Sensitive Information em Meatmeet
The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise of the user's account if the attacker intercepts a request with active authentication tokens or cracks the MD5 hash sent on login.
CVE-2025-65826
Crítica · 9.8
CWE-312 10/12/2025
Cleartext Storage of Sensitive Information em Meatmeet
The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical location of the Wi-Fi network, they could gain unauthorized access to the Wi-Fi network of the vendor. Additionally, if an attacker were located in close physical proximity to the device when it was first set up, they may be able to force the device to auto-connect to an attacker-controlled access point by setting the SSID and password to the same as which was found in the firmware file.
CVE-2025-65820
Crítica · 9.8
CWE-200 10/12/2025
Exposure of Sensitive Information em Meatmeet
An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden page. This page, which is not available through the normal flows of the application, contains several devices which can be added to your account, two of which have not been publicly released. As a result of this vulnerability, the attacker can gain insight into unreleased Meatmeet devices.