https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-11136.htmlhttps://patchthecve.com/cve/CVE-2017-11136.htmlWed, 17 Jun 2026 01:01:17 +0000MEDIUM 6.5: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. It uses RSA to exchange a secret for symmetric encryption of messages. However, the private RSA key is not only stored on the client but transmitted to the backend, https://patchthecve.com/cve/CVE-2017-11135.htmlhttps://patchthecve.com/cve/CVE-2017-11135.htmlWed, 17 Jun 2026 01:01:17 +0000HIGH 7.5: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The logout mechanism does not check for authorization. Therefore, an attacker only needs to know the device ID. This causes a denial of service. This might be interphttps://patchthecve.com/cve/CVE-2017-11134.htmlhttps://patchthecve.com/cve/CVE-2017-11134.htmlWed, 17 Jun 2026 01:01:16 +0000MEDIUM 6.5: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them.https://patchthecve.com/cve/CVE-2017-11133.htmlhttps://patchthecve.com/cve/CVE-2017-11133.htmlWed, 17 Jun 2026 01:01:16 +0000HIGH 7.5: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. To encrypt messages, AES in CBC mode is used with a pseudo-random secret. This secret and the IV are generated with math.random() in previous versions and with Crypthttps://patchthecve.com/cve/CVE-2017-11131.htmlhttps://patchthecve.com/cve/CVE-2017-11131.htmlWed, 17 Jun 2026 01:01:16 +0000MEDIUM 5.9: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. For authentication, the user password is hashed directly with SHA-512 without a salt or another key-derivation mechanism to enable a secure secret for authenticationhttps://patchthecve.com/cve/CVE-2017-11130.htmlhttps://patchthecve.com/cve/CVE-2017-11130.htmlWed, 17 Jun 2026 01:01:16 +0000HIGH 8.1: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android, through 0.0.80w for Web, and through 0.0.86 for Desktop. The product's protocol only tries to ensure confidentiality. In the whole protocol, no integrity or authenticity checks are done. Therefore man-in-the-middle attackehttps://patchthecve.com/cve/CVE-2017-11129.htmlhttps://patchthecve.com/cve/CVE-2017-11129.htmlWed, 17 Jun 2026 01:01:16 +0000CRITICAL 9.8: An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The keystore is locked with a hard-coded password. Therefore, everyone with access to the keystore can read the content out, for example the private key of the user.