CVE-2018-17404

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The SBIbuddy (aka com.sbi.erupee) application 1.41 and 1.42 for Android might allow an attacker to sniff private information such as mobile number, PAN number (from a government-issued ID), and date of birth.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/magicj3lly/appexploits/blob/master/SBI_PrivacyViolation.pdfExploit, Third Party Advisory
https://github.com/magicj3lly/appexploits/blob/master/SBI_PrivacyViolation.pdfExploit, Third Party Advisory

Timeline

Published: Sep 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-174077.8An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the CVE-2018-174087.8Stack-based buffer overflows in Zahir Accounting Enterprise Plus 6 through build 10b allow remote attackers to execute arbitrary code via a CVE-2018-17416.5IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cau CVE-2018-174109.8Horus CMS allows SQL Injection, as demonstrated by a request to the /busca or /home URI.CVE-2018-174119.8An XML External Entity (XXE) vulnerability exists in iWay Data Quality Suite Web Console 10.6.1.ga-2016-11-20.CVE-2018-174129.8zzcms v8.3 contains a SQL Injection vulnerability in /user/logincheck.php via an X-Forwarded-For HTTP header.CVE-2018-174136.1XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.CVE-2018-174148.8zzcms v8.3 has a SQL injection in /user/jobmanage.php via the bigclass parameter.CVE-2018-174158.8zzcms V8.3 has a SQL injection in /user/zs_elite.php via the id parameter.CVE-2018-174167.2A SQL injection vulnerability exists in zzcms v8.3 via the /admin/adclass.php bigclassid parameter.CVE-2018-174187.2Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP file CVE-2018-174197.5An issue was discovered in setTA in scan_rr.go in the Miek Gieben DNS library before 1.0.10 for Go. A dns.ParseZone() parsing error causes a