CVE-2024-36279

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Reliance on obfuscation or encryption of security-relevant inputs without integrity checking issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If this vulnerability is exploited, the content of direct messages (DMs) between users may be manipulated by a man-in-the-middle attack.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-649

Affected software

Vendor	Product	Versions
FreeFrom K.K.	"FreeFrom - the nostr client" App for Android	prior to 1.3.5
FreeFrom K.K.	"FreeFrom - the nostr client" App for iOS	prior to 1.3.5
freefrom_kk	freefrom_the_nostr_client_app	< 1.3.5

References

Timeline

Published: Jun 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-36283.8The EasyEvent WordPress plugin through 1.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such CVE-2024-362806.7Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an authenticated user to pot CVE-2024-362815.5In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status r CVE-2024-362828.2Improper input validation in the Intel(R) Server Board S2600ST Family BIOS and Firmware Update software all versions may allow a privileged CVE-2024-362836.7Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authenticated user to potent CVE-2024-362845.5Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an authenticated user to potentially ena CVE-2024-362855.6Race condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an authenticated CVE-2024-362865.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy CVE-2024-362873.3Mattermost Desktop App versions <=5.7.0 fail to disable certain Electron debug flags which allows for bypassing TCC restrictions on macOS.CVE-2024-362885.5In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() Th CVE-2024-362895.3Reusing a nonce, key pair in encryption issue exists in "FreeFrom - the nostr client" App versions prior to 1.3.5 for Android and iOS. If th CVE-2024-36292.4The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers