CVE-2006-4745 ScaryBear PocketExpense Pro 3.9.1 uses an internally recorded key to protect a data file whose contents are stored in plaintext, which allows local users to disable authentication and access the file....
LowCVSS 3.6
EPSS 0.43%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ScaryBear PocketExpense Pro 3.9.1 uses an internally recorded key to protect a data file whose contents are stored in plaintext, which allows local users to disable authentication and access the file by modifying a certain value in the file header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| scarybear pocketexpense pro | = 3.9.1 | No fix listed |
References
- airscanner.com exploit vendor-advisory
- 1559 third-party-advisory
- 20060907 Airscanner Mobile Security Advisory #06260602: Pocket Expense Pro 3.9.1 Authentication Bypass mailing-list