CVE-2019-14808

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

An issue was discovered in the RENPHO application 3.0.0 for iOS. It transmits JSON data unencrypted to a server without an integrity check, if a user changes personal data in his profile tab (e.g., exposure of his birthday) or logs into his account (i.e., exposure of credentials).

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/154772/RENPHO-3.0.0-Information-Disclosure.htmlThird Party Advisory, VDB Entry
https://apps.apple.com/us/app/renpho/id1219889310Product
https://renpho.com/pages/contact-usVendor Advisory
http://packetstormsecurity.com/files/154772/RENPHO-3.0.0-Information-Disclosure.htmlThird Party Advisory, VDB Entry
https://apps.apple.com/us/app/renpho/id1219889310Product
https://renpho.com/pages/contact-usVendor Advisory

Timeline

Published: Oct 9, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148099.8net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applica CVE-2019-14814.3An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Medi CVE-2019-148105.9A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LD CVE-2019-148117.8A flaw was found in, ghostscript versions prior to 9.50, in the .pdf_hook_DSC_Creator procedure where it did not properly secure its privile CVE-2019-148127.8A flaw was found in all ghostscript versions 9.x before 9.50, in the .setuserparams2 procedure where it did not properly secure its privileg CVE-2019-148139.8A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged CVE-2019-148147.8There is heap-based buffer overflow in Linux kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, tha CVE-2019-148157.8A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver.CVE-2019-148167.8There is heap-based buffer overflow in kernel, all versions up to, excluding 5.3, in the marvell wifi chip driver in Linux kernel, that allo CVE-2019-148177.8A flaw was found in, ghostscript versions prior to 9.50, in the .pdfexectoken and other procedures where it did not properly secure its priv CVE-2019-148187.5A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a CVE-2019-148198.8A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is as