https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-3391.htmlhttps://patchthecve.com/cve/CVE-2021-3391.htmlWed, 17 Jun 2026 04:05:00 +0000MEDIUM 5.3: MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error messagehttps://patchthecve.com/cve/CVE-2020-35138.htmlhttps://patchthecve.com/cve/CVE-2020-35138.htmlWed, 17 Jun 2026 03:13:26 +0000CRITICAL 9.8: The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.jahttps://patchthecve.com/cve/CVE-2020-35137.htmlhttps://patchthecve.com/cve/CVE-2020-35137.htmlWed, 17 Jun 2026 03:13:26 +0000HIGH 7.5: The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in com/mobileiron/registration/RegisterActivity.java and can be used for api/v1/gatewahttps://patchthecve.com/cve/CVE-2014-5903.htmlhttps://patchthecve.com/cve/CVE-2014-5903.htmlWed, 17 Jun 2026 00:12:16 +0000MEDIUM 5.4: The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.