# SOME DESCRIPTIVE TITLE.
# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
# This file is distributed under the same license as the PACKAGE package.
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
#
#, fuzzy
msgid ""
msgstr ""
"Project-Id-Version: PACKAGE VERSION\n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2017-07-04 09:45+0000\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language-Team: LANGUAGE <LL@li.org>\n"
"Language: \n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=UTF-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Plural-Forms: nplurals=1; plural=0;\n"

#: report.html:5
msgid "confidential"
msgstr "ために"

#: report.html:17
msgid "Security Report"
msgstr "セキュリティレポート"

#: report.html:17
msgid "For Internal Purpose"
msgstr "内部目的のために"

#: report.html:17
msgid "Prepared For"
msgstr "以下のために準備："

#: report.html:17
msgid ""
"Prepared by XYSec Labs Pte. Ltd. Portions of this document and the templates "
"used in its production are the property of XYSec Labs Pte. Ltd. and cannot "
"be copied without permission."
msgstr ""
"XYSec研究所のPteによって調製しました。株式会社本書の一部およびその製造に使用"
"されるテンプレートは、XYSec研究所のPteの財産です。 （株）および許可なしにコ"
"ピーすることはできません。"

#: report.html:17
msgid ""
"While precautions have been taken in the preparation of this document, XYSec "
"Labs Pte. Ltd., the publisher, and the author(s) assume no responsibility "
"for errors, omissions, or for damages resulting from the use of the "
"information contained herein. Use of XYSec Labs Pte. Ltd. services does not "
"guarantee the security of a system, or that intrusions will not occur."
msgstr ""
"注意事項は、本文書、XYSec研究所のPteの準備で撮影してきたが。 （株）、出版社、"
"及び著者（複数可）は、エラーのため、省略、または本明細書に含まれている情報の"
"使用から生じた損害について、一切の責任を負いません。 XYSec研究所のPteの使"
"用。 （株）サービスは、システムのセキュリティを保証する、または侵入が発生しな"
"いことはありません。"

#: report.html:17
msgid "Application Details"
msgstr "アプリケーションの詳細"

#: report.html:17
msgid "Application Name"
msgstr "アプリケーションログ"

#: report.html:17
msgid "Platform"
msgstr ""

#: report.html:17
msgid "Application Namespace"
msgstr "アプリケーションログ"

#: report.html:17
msgid "Version"
msgstr ""

#: report.html:17
msgid "Audit Date"
msgstr ""

#: report.html:17
msgid "Application SHA1 Hash"
msgstr "アプリケーションログ"

#: report.html:17
msgid "Application MD5 Hash"
msgstr "アプリケーションの詳細"

#: report.html:17
msgid "Table Of Contents"
msgstr "目次"

#: report.html:17 report.html:24
msgid "Report Summary"
msgstr "レポートの概要"

#: report.html:17 report.html:24
msgid "Audit Summary"
msgstr "監査の概要"

#: report.html:17 report.html:24
msgid "Appknox Security Rating"
msgstr "Appknoxセキュリティ評価"

#: report.html:19 report.html:27
msgid "Noncompliant Code Example"
msgstr ""

#: report.html:20 report.html:28
msgid "Compliant Solution"
msgstr ""

#: report.html:21 report.html:29
msgid "Business Implication"
msgstr "ビジネスロジック"

#: report.html:22 report.html:30
msgid "Related Vulnerabilities"
msgstr ""

#: report.html:24
msgid ""
"Appknox conducted a security assessment of the mobile application. This "
"report contains all the findings during the automated auditing process. It "
"also contains the process of discovering those vulnerabilities in the first "
"place, and ways to remediate those issues."
msgstr ""

#: report.html:24
msgid "Priority Level"
msgstr ""

#: report.html:24
msgid "Number of failed test cases"
msgstr ""

#: report.html:24
msgid "Critical Risk"
msgstr ""

#: report.html:24
msgid "High Risk"
msgstr ""

#: report.html:24
msgid "Medium Risk"
msgstr ""

#: report.html:24
msgid "Low Risk"
msgstr ""

#: report.html:24
msgid "Appknox Security Rating:"
msgstr "Appknoxセキュリティ評価"

#: report.html:24
msgid "Unsecured"
msgstr ""

#: report.html:25
msgid "Risk Rating"
msgstr ""

#: report.html:25
msgid "Risk Assessment"
msgstr ""

#: subheadings.py:19
msgid "setPluginState()"
msgstr ""

#: subheadings.py:20
msgid ""
"\n"
"The setPluginState() method tells the WebView to enable, disable, or\n"
"have plugins enabled on demand.\n"
"\n"
"  ------------ "
"-------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n"
"  ON           any object will be loaded even if a plugin does not exist to "
"handle the content\n"
"  ON\\_DEMAND   if there is a plugin that can handle the content, a "
"placeholder is shown until the user clicks on the placeholder.Once clicked, "
"the plugin will be enabled on the page.\n"
"  OFF          all plugins will be turned off and any fall-back content will "
"be used\n"
"  ------------ "
"-------------------------------------------------------------------------------------------------------------------------------------------------------------------------\n"
"\n"
"The default is OFF.\n"
msgstr ""

#: subheadings.py:37
msgid "setAllowFileAccess()"
msgstr ""

#: subheadings.py:38
msgid ""
"\n"
"The setAllowFileAccess() method enables or disables file access within\n"
"WebView.\n"
"\n"
"The default is true.\n"
msgstr ""

#: subheadings.py:49
msgid "setAllowContentAccess()"
msgstr ""

#: subheadings.py:50
msgid ""
"\n"
"The setAllowContentAccess() method enables or disables content URL\n"
"access within WebView. Content URL access allows WebView to load content\n"
"from a content provider installed in the system.\n"
"\n"
"The default is true.\n"
msgstr ""

#: subheadings.py:62
msgid "setAllowFileAccessFromFileURLs()"
msgstr ""

#: subheadings.py:63
msgid ""
"\n"
"Sets whether JavaScript running in the context of a file scheme URL\n"
"should be allowed to access content from other file scheme URLs. To\n"
"enable the most restrictive, and therefore secure policy, this setting\n"
"should be disabled. Note that the value of this setting is ignored if\n"
"the value of getAllowUniversalAccessFromFileURLs() is true.\n"
"\n"
"The default value is true for API level ICE\\_CREAM\\_SANDWICH\\_MR1 (API\n"
"level 15) and below, and false for API level JELLY\\_BEAN (API level 16)\n"
"and above.\n"
msgstr ""

#: subheadings.py:79
msgid "setAllowUniversalAccessFromFileURLs()"
msgstr ""

#: subheadings.py:80 vulnerabilities.py:1162
msgid ""
"\n"
"Sets whether JavaScript running in the context of a file scheme URL\n"
"should be allowed to access content from any origin. This includes\n"
"access to content from other file scheme URLs. To enable the most\n"
"restrictive, and therefore secure policy, this setting should be\n"
"disabled.\n"
"\n"
"The default value is true for API level ICE\\_CREAM\\_SANDWICH\\_MR1 (API\n"
"level 15) and below, and false for API level JELLY\\_BEAN (API level 16)\n"
"and above.\n"
msgstr ""

#: subheadings.py:96
msgid "Security Concerns for WebView Class"
msgstr ""

#: subheadings.py:97
msgid ""
"\n"
"When an activity has WebView embedded to display web pages, any\n"
"application can create and send an Intent object with a given URI to the\n"
"activity to request that a web page be displayed.\n"
"\n"
"WebView can recognize a variety of schemes, including the file: scheme.\n"
"A malicious application may create and store a crafted content on its\n"
"local storage area, make it accessible with MODE\\_WORLD\\_READABLE\n"
"permission, and send the URI (using the file: scheme) of this content to\n"
"a target activity. The target activity renders this content.\n"
"\n"
"When the target activity (webView object) sets JavaScript enabled, it\n"
"can be abused to access the target application's resources.\n"
"\n"
"Android 4.1 provides additional methods to control file scheme access:\n"
"\n"
"-   WebSettings\\#setAllowFileAccessFromFileURLs\n"
"-   WebSettings\\#setAllowUniversalAccessFromFileURLs\n"
"\n"
msgstr ""

#: subheadings.py:122 subheadings.py:291
msgid "Example Proof of Concept"
msgstr ""

#: subheadings.py:123
msgid ""
"\n"
"This code shows how the vulnerability can be exploited:\n"
"\n"
"    // Malicious application prepares some crafted HTML file,\n"
"    // places it on a local storage, makes accessible from\n"
"    // other applications. The following code sends an\n"
"    // intent to a target application (jp.vulnerable.android.app)\n"
"    // to make it access and process the malicious HTML file.\n"
"\n"
"    String pkg = \"jp.vulnerable.android.app\";\n"
"    String cls = pkg + \".DummyLauncherActivity\";\n"
"    String uri = \"file:///[crafted HTML file]\";\n"
"    Intent intent = new Intent();\n"
"    intent.setClassName(pkg, cls);\n"
"    intent.putExtra(\"url\", uri);\n"
"    this.startActivity(intent);\n"
msgstr ""

#: subheadings.py:145
msgid "Public"
msgstr ""

#: subheadings.py:146
msgid ""
"\n"
"By specifying the android:exported attribute in the AndroidManifest.xml\n"
"file, a content provider is made public to other applications. For\n"
"Android applications before API Level 16, a content provider is public\n"
"unless explicitly specified android:exported=\"false\". For example,\n"
"\n"
"    <provider android:exported=\"true\" android:name=\"MyContentProvider\"\n"
"    android:authorities=\"com.example.mycontentprovider\" />\n"
"\n"
"If a content provider is to be made public, the data stored in a\n"
"provider may be accessed from other applications. Therefore, it should\n"
"be designed to handle only non-sensitive information.\n"
msgstr ""

#: subheadings.py:164
msgid "Private"
msgstr ""

#: subheadings.py:165
msgid ""
"\n"
"You can make your provider private by specifying the android:exported\n"
"attribute in the AndroidManifest.xml file. From API Level 17 and later,\n"
"a content provider is private if you do not specify the attribute\n"
"explicitly. For example,\n"
"\n"
"    <provider android:exported=\"false\" android:name=\"MyContentProvider\"\n"
"    android:authorities=\"com.example.mycontentprovider\" />\n"
"\n"
"If you do not need to share a content provider with other applications,\n"
"it should be declared android:exported=\"false\" in the manifest file.\n"
"Note, however, in API Level 8 and earlier, even if you explicitly\n"
"declare android:exported=\"false\", your content provider is accessible\n"
"from other apps.\n"
msgstr ""

#: subheadings.py:185
msgid "Example Proof of Concept:"
msgstr ""

#: subheadings.py:186
#, python-format
msgid ""
"\n"
"The following code shows how this could be exploited:\n"
"\n"
"    // check whether movatwi is installed.\n"
"    try {\n"
"        ApplicationInfo info = getPackageManager().getApplicationInfo(\"jp."
"co.vulnerable\", 0);\n"
"        [cjl5]\n"
"    } catch (NameNotFoundException e) {\n"
"        Log.w(TAG, \"the app is not installed.\");\n"
"        return;\n"
"    }\n"
"    // extract account data through content provider\n"
"    Uri uri = Uri.parse(\"content://jp.co.vulnerable.accountprovider\");\n"
"    Cursor cur = getContentResolver().query(uri, null, null, null, null);\n"
"    [cjl6]\n"
"    StringBuilder sb = new StringBuilder();\n"
"    if (cur != null) {\n"
"        int ri = 0;\n"
"        while (cur.moveToNext()) {\n"
"            ++ri;\n"
"            Log.i(TAG, String.format(\"row[%d]:\", ri));\n"
"            sb.setLength(0);\n"
"            for (int i = 0; i < cur.getColumnCount(); ++i) {\n"
"                String column = cur.getColumnName(i);\n"
"                String value = cur.getString(i);\n"
"                if (value != null) {\n"
"                    value = value.replaceAll(\"[\\r\n"
"]\", \"\");\n"
"                }\n"
"                Log.i(TAG, String.format(\"\t%s:\t%s\", column, value));\n"
"            }\n"
"        }\n"
"    } else {\n"
"        Log.i(TAG, \"Can't get the app information.\");\n"
"    }\n"
msgstr ""

#: subheadings.py:226
msgid "To Log Output"
msgstr ""

#: subheadings.py:227
msgid ""
"\n"
"The android.util.Log class allows a number of possibilities:\n"
"\n"
"Log.d (Debug)\n"
"\n"
"Log.e (Error)\n"
"\n"
"Log.i (Info)\n"
"\n"
"Log.v (Verbose)\n"
"\n"
"Log.w (Warn)\n"
msgstr ""

#: subheadings.py:245
msgid "Example:"
msgstr ""

#: subheadings.py:246 vulnerabilities.py:1707
msgid ""
"\n"
"    Log.v(\"method\", Login.TAG + \", account=\" + str1);\n"
"    Log.v(\"method\", Login.TAG + \", password=\" + str2);\n"
msgstr ""

#: subheadings.py:255
msgid "To Obtain Log Output"
msgstr ""

#: subheadings.py:256
msgid ""
"\n"
"Declare READ\\_LOGS permission in the manifest file so that an app can\n"
"read log output:\n"
"\n"
"AndroidManifest.xml:\n"
"\n"
"    <uses-permission android:name=\"android.permission.READ_LOGS\"/>\n"
"\n"
"Call logcat from an application:\n"
"\n"
"    Process mProc = Runtime.getRuntime().exec(\n"
"\n"
"    new String[]{\"logcat\", \"-d\", \"method:V *:S$Bc`W^(B)\"});\n"
"\n"
"    BufferedReader mReader = new BufferedReader(\n"
"\n"
"        new InputStreamReader(proc.getInputStream()));\n"
"\n"
"Prior to Android 4.0, any application with READ\\_LOGS permission could\n"
"obtain all the other applications' log output. After Android 4.1, the\n"
"specification of READ\\_LOGS permission has been changed. Even\n"
"applications with READ\\_LOGS permission cannot obtain log output from\n"
"other applications.\n"
"\n"
"However, by connecting an Android device to a PC, log output from other\n"
"applications can be obtained.\n"
"\n"
"Therefore, it is important that applications do not send sensitive\n"
"information to log output.\n"
msgstr ""

#: subheadings.py:292
msgid ""
"\n"
"Example code of obtaining log output from a vulnerable application is as\n"
"follows:\n"
"\n"
"    try {\n"
"        Process mLogcatProc;\n"
"\n"
"        mLogcatProc = Runtime.getRuntime().exec(new String[]\n"
"\n"
"            {\"logcat\", \"-d\", \"LoginAsyncTask:I APIClient:I method:V *:S"
"\" });\n"
"\n"
"        BufferedReader reader = new BufferedReader(new InputStreamReader(\n"
"\n"
"            mLogcatProc.getInputStream()));\n"
"\n"
"        String line;\n"
"\n"
"        String separator = System.getProperty(\"line.separator\");\n"
"\n"
"        while ((line = reader.readLine()) != null) {\n"
"\n"
"            slog.append(line);\n"
"\n"
"            slog.append(separator);\n"
"        }\n"
"\n"
"        Toast.makeText(this, \"Obtained log information\",\n"
"            Toast.LENGTH_SHORT).show();\n"
"\n"
"    }\n"
"\n"
"    catch (IOException e) {\n"
"\n"
"    // handle error\n"
"\n"
"    }\n"
"\n"
"    TextView tView = (TextView) findViewById(R.id.logView);\n"
"\n"
"    tView.setText(slog);\n"
msgstr ""

#: subheadings.py:338
msgid "Applicability"
msgstr ""

#: subheadings.py:339 vulnerabilities.py:1964
msgid ""
"\n"
"Applications should make sure that they do not send sensitive\n"
"information to log output. If the app includes a third party library,\n"
"the developer should make sure that the library does not send sensitive\n"
"information to log output. One common solution is for an application to\n"
"declare and use a custom log class, so that log output is automatically\n"
"turned on/off based on Debug/Release. Developers can use ProGuard to\n"
"delete specific method calls. This assumes that the method contains no\n"
"side effects.\n"
msgstr ""

#: subheadings.py:354
msgid "General Best Practices"
msgstr ""

#: subheadings.py:355
msgid ""
"\n"
"-   Assume that the network layer is not secure and may potentially be\n"
"    hostile and eavesdropping.\n"
"-   Enforce the use of SSL/TLS for all transport channels in which\n"
"    sensitive information, session tokens, or other sensitive data is\n"
"    going to be communicated to a backend API or web service.\n"
"-   Remember to account for outside entities like third-party analytics,\n"
"    social networks, etc. and use their SSL versions even when an\n"
"    application runs a routine via the browser/webkit. Mixed SSL\n"
"    sessions should be avoided and may expose the user's session ID.\n"
"-   Use strong, industry standard encryption algorithms and appropriate\n"
"    key lengths.\n"
"-   Use certificates signed by a trusted CA provider.\n"
"-   Never allow self-signed certificates, and consider certificate\n"
"    pinning for security conscious applications.\n"
"-   Do not disable or ignore SSL chain verification.\n"
"-   Only establish a secure connection after verifying the identity of\n"
"    the endpoint server with trusted certificates in the key chain.\n"
"-   Alert users through the UI if an invalid certificate is detected.\n"
"-   Do not send sensitive data over alternate channels, such as SMS,\n"
"    MMS, or notifications.\n"
"\n"
msgstr ""

#: vulnerabilities.py:928 vulnerabilities.py:929
msgid "Unprotected Services"
msgstr ""

#: vulnerabilities.py:930
msgid "Are exported services sufficiently protected?"
msgstr ""

#: vulnerabilities.py:931
msgid "Exported services in the app are sufficiently protected."
msgstr ""

#: vulnerabilities.py:932
msgid ""
"\n"
"The `setPluginState()` method tells the WebView to enable, disable, or\n"
"have plugins enabled on demand.\n"
"\n"
"- `ON`: any object will be loaded even if a plugin does not exist to handle "
"the content\n"
"- `ON_DEMAND`: if there is a plugin that can handle the content, a "
"placeholder is shown until the user clicks on the placeholder. Once clicked, "
"the plugin will be enabled on the page.\n"
"- `OFF`: (default) all plugins will be turned off and any fall-back content "
"will be used\n"
"\n"
msgstr ""

#: vulnerabilities.py:941
msgid ""
"\n"
"[Chin, et al.](https://www.securecoding.cert.org/confluence/display/java/AA."
"+References#AA.References-Chin11)\n"
"say: \"If a Service is exported and not\n"
"protected with strong permissions, then any application can start and\n"
"bind to the Service. Depending on the duties of a particular Service, it\n"
"may leak information or perform unauthorized tasks. Services sometimes\n"
"maintain singleton application state, which could be corrupted.\"\n"
"\n"
"To guard against such eventualities, an exported service should always\n"
"be protected with strong permissions.\n"
msgstr ""

#: vulnerabilities.py:952
msgid ""
"\n"
"A service was found to be shared with other apps on the device without\n"
"an intent filter or a permission requirement therefore leaving it\n"
"accessible to any other application on the device.\n"
msgstr ""

#: vulnerabilities.py:957 vulnerabilities.py:961
msgid ""
"\n"
"Data can be shared through other services resulting in loss of sensitive\n"
"information.\n"
msgstr ""

#: vulnerabilities.py:965
msgid ""
"\n"
"Always protect the Activity with `export=false`\n"
"\n"
msgstr ""

#: vulnerabilities.py:978 vulnerabilities.py:979
msgid "Improper Content Provider Permissions"
msgstr ""

#: vulnerabilities.py:980
msgid "Are Content Providers sufficiently protected?"
msgstr ""

#: vulnerabilities.py:981
msgid ""
"Application seems to properly implement SSL, or HTTPS is not implemented."
msgstr ""

#: vulnerabilities.py:982
msgid ""
"\n"
"The `setAllowFileAccess()` method enables or disables file access within\n"
"WebView.\n"
"\n"
"The default is true.\n"
msgstr ""

#: vulnerabilities.py:988
msgid ""
"\n"
"The `ContentProvider` class provides a mechanism for managing and sharing\n"
"data with other applications. When sharing a provider's data with other\n"
"apps, access control should be carefully implemented to prohibit\n"
"unauthorized access to sensitive data.\n"
"\n"
"There are three ways to limit access to the content provider:\n"
"\n"
"- Public\n"
"- Private\n"
"- Restricted access\n"
"\n"
msgstr ""

#: vulnerabilities.py:1001
msgid ""
"\n"
"A content provider permission was set to allow access from any other app\n"
"on the device. Content providers may contain sensitive information about\n"
"an app and therefore should not be shared.\n"
msgstr ""

#: vulnerabilities.py:1006 vulnerabilities.py:1011
msgid ""
"\n"
"If security controls are not properly implemented, content providers can\n"
"lead to client side attacks like SQL injection. This works similarly to\n"
"traditional SQL injection attacks.\n"
msgstr ""

#: vulnerabilities.py:1016
msgid ""
"\n"
"The following entry in the AndroidManifest.xml file makes the content\n"
"provider private so that other apps cannot access the data:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1021
msgid ""
"\n"
"MovatwiTouch, a Twitter client application, used a content provider to\n"
"manage Twitter's consumer key, consumer secret, and access token.\n"
"However, the content provider was made public, which enabled\n"
"applications installed on users' devices to access this sensitive\n"
"information.\n"
"\n"
"The following entry in the AndroidManifest.xml does not have the\n"
"`android:exported` attribute, which means, before API Level 16, the\n"
"content provider is made public:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1033
msgid ""
"\n"
"- [JVN\\#90289505](https://jvn.jp/en/jp/JVN90289505/) Content provider\n"
"  in MovatwiTouch fails to restrict access permissions\n"
"\n"
msgstr ""

#: vulnerabilities.py:1046 vulnerabilities.py:1047
msgid "Application Debugging"
msgstr ""

#: vulnerabilities.py:1048
msgid "Does the application have debug enabled?"
msgstr ""

#: vulnerabilities.py:1049
msgid "Debug was found to be disabled."
msgstr ""

#: vulnerabilities.py:1050
msgid ""
"\n"
"The `setAllowContentAccess()` method enables or disables content URL\n"
"access within WebView. Content URL access allows WebView to load content\n"
"from a content provider installed in the system.\n"
"\n"
"The default is true.\n"
msgstr ""

#: vulnerabilities.py:1057
msgid ""
"\n"
"Android allows the attribute `android:debuggable` to be set to true so\n"
"that the app can be debugged. By default this attribute is disabled,\n"
"i.e., it is set to false, but it may be set to true to help with\n"
"debugging during development of the app. However, an app should never be\n"
"released with this attribute set to true as it enables users to gain\n"
"access to details of the app that should be kept secure. With the\n"
"attribute set to true, users can debug the app even without access to\n"
"its source code.\n"
msgstr ""

#: vulnerabilities.py:1067
msgid ""
"\n"
"Debugging was enabled on the app which makes it easier for reverse\n"
"engineers to hook a debugger to it. This allows dumping a stack trace\n"
"and accessing debugging helper classes.\n"
msgstr ""

#: vulnerabilities.py:1072 vulnerabilities.py:1076
msgid ""
"\n"
"Application can be debugged and reverse engineers can debug and manipulate "
"the\n"
"Runtime logic of the application.\n"
msgstr ""

#: vulnerabilities.py:1080
msgid ""
"\n"
"Ensure that the `android:debuggable` attribute is set to false before the\n"
"app is released:\n"
"\n"
"    android:debuggable=\"false\"\n"
"\n"
"Note that some development environments (including Eclipse/ADT and Ant)\n"
"automatically set `android:debuggable` to true for incremental or\n"
"debugging builds but set it to false for release builds.\n"
msgstr ""

#: vulnerabilities.py:1090
msgid ""
"\n"
"This non-compliant code example shows an app that has the\n"
"`android:debuggable` attribute set to true being accessed to reveal\n"
"sensitive data.\n"
"\n"
msgstr ""

#: vulnerabilities.py:1095
msgid ""
"\n"
"\n"
"Clearly, with the `android:debuggable` attribute set to true, sensitive\n"
"date related to the app can be revealed to any user.\n"
msgstr ""

#: vulnerabilities.py:1109 vulnerabilities.py:1110
msgid "Improper Custom Permissions"
msgstr ""

#: vulnerabilities.py:1111
msgid "Are protection levels of the custom permission safe?"
msgstr ""

#: vulnerabilities.py:1112
msgid ""
"Custom permissions in the app have sufficient protection levels, or custom "
"permissions are absent."
msgstr ""

#: vulnerabilities.py:1113
msgid ""
"\n"
"Sets whether JavaScript running in the context of a file scheme URL\n"
"should be allowed to access content from other file scheme URLs. To\n"
"enable the most restrictive, and therefore secure policy, this setting\n"
"should be disabled. Note that the value of this setting is ignored if\n"
"the value of `getAllowUniversalAccessFromFileURLs()` is true.\n"
"\n"
"The default value is true for API level ICE\\_CREAM\\_SANDWICH\\_MR1 (API\n"
"level 15) and below, and false for API level JELLY\\_BEAN (API level 16)\n"
"and above.\n"
msgstr ""

#: vulnerabilities.py:1124
msgid ""
"\n"
"If an app is using a granted permission to respond to a calling app then\n"
"it must check that the calling app as that permission as well.\n"
"Otherwise, the responding app may be granting privileges to the calling\n"
"app that it should not have. (This is sometimes called the \"confused\n"
"deputy\" problem.)\n"
"\n"
"The methods `Context.checkCallingPermission()` and\n"
"`Context.enforceCallingPermission()` can be used to ensure that the\n"
"calling app has the correct permissions.\n"
msgstr ""

#: vulnerabilities.py:1135
msgid ""
"\n"
"A custom permission controls whether other applications can access the\n"
"affected apps features. The use of the dangerous label places no\n"
"restrictions on which apps can access the application declaring the\n"
"permission but the user will be warned that the dangerous permission is\n"
"required during installation.\n"
msgstr ""

#: vulnerabilities.py:1144
msgid ""
"\n"
"Remove custom permissions which are not required from the\n"
"custom-permission sets defined in the `AndroidManifest.xml`\n"
msgstr ""

#: vulnerabilities.py:1158 vulnerabilities.py:1159
msgid "Broken SSL Trust Manager"
msgstr ""

#: vulnerabilities.py:1160
msgid "Is the Trust Manager for SSL implemented properly?"
msgstr ""

#: vulnerabilities.py:1161
msgid "Trust Managers for SSL, if any, seem to be properly implemented."
msgstr ""

#: vulnerabilities.py:1173
msgid ""
"\n"
"Android apps that use SSL/TLS protocols for secure communication should\n"
"properly verify server certificates. The basic verification includes:\n"
"\n"
"- verify that the subject (CN) of X.509 certificate and the URL\n"
"  matches\n"
"- verify that the certificate is signed by the trusted CA\n"
"- verify that the signature is correct\n"
"- verify that the certificate is not expired\n"
"\n"
"A developer has the freedom to customize their SSL implementation. The\n"
"developer should properly use SSL as appropriate to the intent of the\n"
"app and the environment the apps are used in. If the SSL is not\n"
"correctly used, a user's sensitive data may leak via the vulnerable SSL\n"
"communication channel.\n"
"\n"
"Fahl et al [Fahl\n"
"2012](https://www.securecoding.cert.org/confluence/display/java/AA."
"+References#AA.References-Fahl2012)\n"
"describes the following patterns of the insecure use of SSL:\n"
"\n"
"- Trusting All Certificates: The developer implements the\n"
"  TrustManager interface so that it will trust all the server\n"
"  certificate (regardless of who signed it, what is the CN etc.)\n"
"- Mixed-Mode/No SSL: A developer mixes secure and insecure\n"
"  connections in the same app or does not use SSL at all.\n"
"\n"
"On Android, using `HttpURLConnection` is recommended for HTTP client\n"
"implementation.\n"
msgstr ""

#: vulnerabilities.py:1202
msgid ""
"\n"
"Implements naive certificate check. This Trust Manager breaks\n"
"certificate validation.\n"
msgstr ""

#: vulnerabilities.py:1206 vulnerabilities.py:1215 vulnerabilities.py:1299
#: vulnerabilities.py:1308 vulnerabilities.py:1458 vulnerabilities.py:1467
msgid ""
"\n"
"In the event that a user (anonymous or verified) is able to execute\n"
"over-privileged functionality, the business may experience:\n"
"\n"
"- Reputational Damage\n"
"- Fraud\n"
"- Information Theft\n"
"\n"
msgstr ""

#: vulnerabilities.py:1224
msgid ""
"\n"
"The compliant solution is given below which shows how to solve the issue\n"
"with the non compliant code:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1228
msgid ""
"\n"
"\n"
"The method `checkCertTrusted()` gives an idea about how to solve this\n"
"issue. If a custom keystore is being used to load certificates then we\n"
"need to define and do a failsafe load of those certificates.\n"
msgstr ""

#: vulnerabilities.py:1234
msgid ""
"\n"
"The following code implements a custom `MySSLSocketFactory` class that\n"
"inherits `javax.net.ssl.SSLContext:`\n"
"\n"
msgstr ""

#: vulnerabilities.py:1238
msgid ""
"\n"
"\n"
"In the example above, `checkClientTrusted()` and `checkServerTrusted()` are\n"
"overridden to make a blank implementation so that SSLSocketFactory does\n"
"not verify the SSL certificate. The MySSLSocketFactory class is used to\n"
"create an instance of HttpClient in another part of the application.\n"
msgstr ""

#: vulnerabilities.py:1245 vulnerabilities.py:1330 vulnerabilities.py:1408
#: vulnerabilities.py:1496 vulnerabilities.py:1570
msgid ""
"\n"
"- [JVN\\#39218538](http://jvn.jp/en/jp/JVN39218538/) Pizza Hut Japan\n"
"  Official Order App for Android has a problem whereby it fails to\n"
"  verify SSL server certificates.\n"
"- [JVN\\#75084836](http://jvn.jp/en/jp/JVN75084836/) Yome Collection\n"
"  for Android has a problem with management of IMEI.\n"
"- [JVN\\#68156832](http://jvn.jp/en/jp/JVN68156832/) Yafuoku! contains\n"
"  an issue where it fails to verify SSL server certificates\n"
"\n"
msgstr ""

#: vulnerabilities.py:1262 vulnerabilities.py:1263
msgid "Broken HostnameVerifier for SSL"
msgstr ""

#: vulnerabilities.py:1264
msgid "Is the HostnameVerifier for SSL implemented properly?"
msgstr ""

#: vulnerabilities.py:1265
msgid ""
"HostnameVerifiers for SSL, if any, seem to be verfying hostnames properly."
msgstr ""

#: vulnerabilities.py:1266
msgid ""
"\n"
"When an activity has WebView embedded to display web pages, any\n"
"application can create and send an Intent object with a given URI to the\n"
"activity to request that a web page be displayed.\n"
"\n"
"WebView can recognize a variety of schemes, including the file: scheme.\n"
"A malicious application may create and store a crafted content on its\n"
"local storage area, make it accessible with MODE\\_WORLD\\_READABLE\n"
"permission, and send the URI (using the `file:` scheme) of this content to\n"
"a target activity. The target activity renders this content.\n"
"\n"
"When the target activity (webView object) sets JavaScript enabled, it\n"
"can be abused to access the target application's resources.\n"
"\n"
"Android 4.1 provides additional methods to control file scheme access:\n"
"\n"
"- `WebSettings\\#setAllowFileAccessFromFileURLs`\n"
"- `WebSettings\\#setAllowUniversalAccessFromFileURLs`\n"
"\n"
msgstr ""

#: vulnerabilities.py:1286
msgid ""
"\n"
"Allowing All Hostnames: The app does not verify if the certificate is\n"
"issued for the URL the client is connecting to. For example, when a\n"
"client connects to example.com, it will accept a server certificate\n"
"issued for some-other-domain.com.\n"
"\n"
"On Android, using `HttpURLConnection` is recommended for HTTP client\n"
"implementation.\n"
msgstr ""

#: vulnerabilities.py:1295
msgid ""
"\n"
"Implements naive hostname verification. This HostnameVerifier breaks\n"
"certificate validation!\n"
msgstr ""

#: vulnerabilities.py:1317
msgid ""
"\n"
"The code example shows how to verify hostname using a\n"
"wrappper `HostnameVerifier` which also checks for custom loaded "
"certificates\n"
"\n"
msgstr ""

#: vulnerabilities.py:1322
msgid ""
"\n"
"The following code inherits `javax.net.ssl.SSLContext`:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1325
msgid ""
"\n"
"\n"
"`HostnameVerifier` will always return true without checking the contents\n"
"or verifying the hostname\n"
msgstr ""

#: vulnerabilities.py:1348 vulnerabilities.py:1349
msgid "Insecure SSLSocketFactories"
msgstr ""

#: vulnerabilities.py:1350
msgid "Does the application have a probable SSL error in implementation?"
msgstr ""

#: vulnerabilities.py:1351
msgid "No implementation errors were found."
msgstr ""

#: vulnerabilities.py:1352
msgid ""
"\n"
"This code shows how the vulnerability can be exploited:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1356
msgid ""
"\n"
"Android SDK 4.0 and later offers packages to implement capabilities to\n"
"establish network connections. For example, by using `java.net`\n"
"`javax.net` `android.net` `org.apache.http` a developer can create server\n"
"sockets or HTTP connection. `org.webkit` offers functions necessary to\n"
"implement web browsing capabilities.\n"
"\n"
"A developer has the freedom to customize their SSL implementation. The\n"
"developer should properly use SSL as appropriate to the intent of the\n"
"app and the environment the apps are used in.\n"
"\n"
"On Android, using `HttpURLConnection` is recommended for HTTP client\n"
"implementation.\n"
msgstr ""

#: vulnerabilities.py:1370
msgid ""
"\n"
"SSL Implementations are not proper in this application\n"
msgstr ""

#: vulnerabilities.py:1373 vulnerabilities.py:1377 vulnerabilities.py:1549
#: vulnerabilities.py:1553
msgid ""
"\n"
"If proper implementation of SSL is not used, sensitive data may leak\n"
"from the vulnerable SSL communication channel.\n"
msgstr ""

#: vulnerabilities.py:1381
msgid ""
"\n"
"The compliant solution may vary, depending on the actual implementation.\n"
"For examples of secure implementation such as using a self-signed server\n"
"certificate, please refer to [Android Application Secure Design/Secure\n"
"Coding Guidebook](http://www.jssec.org/dl/android_securecoding.pdf),\n"
"Section 5.4 Communicate by HTTPS.\n"
msgstr ""

#: vulnerabilities.py:1388
msgid ""
"\n"
"The following code implements a custom MySSLSocketFactory class that\n"
"inherits `javax.net.ssl.SSLContext`:\n"
"\n"
"    public class InsecureSocketFactory extends SSLSocketFactory {\n"
"        protected SSLSocketFactory _factory;\n"
"        public InsecureSocketFactory() {\n"
"            try {\n"
"                SSLContext ctx = SSLContext.getInstance(\"SSL\");\n"
"                ctx.init(null, new TrustManager[] { new "
"InsecureTrustManager() }, null);\n"
"                _factory = ctx.getSocketFactory();\n"
"            } catch (Exception e) {\n"
"                throw new RuntimeException(e);\n"
"            }\n"
"        }\n"
"    }\n"
"\n"
"In the example above, the `InsecureSocketFactory` accepts all certificates\n"
"silently, which even bypasses the check for trustmanagers\n"
msgstr ""

#: vulnerabilities.py:1426 vulnerabilities.py:1427
msgid "HostnameVerifier Allowing All Hostnames"
msgstr ""

#: vulnerabilities.py:1428
msgid "Does the application have AllowAllHostnameVerification?"
msgstr ""

#: vulnerabilities.py:1429
msgid "AllowAllHostname is properly configured, or is disabled."
msgstr ""

#: vulnerabilities.py:1430
msgid ""
"\n"
"By specifying the `android:exported` attribute in the `AndroidManifest.xml`\n"
"file, a content provider is made public to other applications. For\n"
"Android applications before API Level 16, a content provider is public\n"
"unless explicitly specified `android:exported=\"false\"`. For example,\n"
"\n"
msgstr ""

#: vulnerabilities.py:1436
msgid ""
"\n"
"If a content provider is to be made public, the data stored in a\n"
"provider may be accessed from other applications. Therefore, it should\n"
"be designed to handle only non-sensitive information.\n"
msgstr ""

#: vulnerabilities.py:1441
msgid ""
"\n"
"Android apps that use SSL/TLS protocols for secure communication should\n"
"properly verify server certificates which should verify that the subject\n"
"(CN) of X.509 certificate and the URL matches\n"
"\n"
"Allowing All Hostnames: The app does not verify if the certificate\n"
"issued is for the URL the client is connecting to. For example, when a\n"
"client connects to example.com, it will accept a server certificate\n"
"issued for some-other-domain.com.\n"
"\n"
"On Android, using `HttpURLConnection` is recommended for HTTP client\n"
"implementation.\n"
msgstr ""

#: vulnerabilities.py:1454
msgid ""
"\n"
"Implements AllowAllHostname verifier which might allow hacker to\n"
"eavesdrop into the connection.\n"
msgstr ""

#: vulnerabilities.py:1476
msgid ""
"\n"
"Never use `SSLSocketFactory.ALLOW\\_ALL\\_HOSTNAME\\_VERIFIER` in\n"
"production code\n"
"\n"
"Please refer to [Android Application Secure Design/Secure Coding\n"
"Guidebook](http://www.jssec.org/dl/android_securecoding.pdf), Section\n"
"5.4 Communicate by HTTPS.\n"
msgstr ""

#: vulnerabilities.py:1484
msgid ""
"\n"
"The following code extends `HttpClient` class that inherits\n"
"`javax.net.ssl.SSLContext`:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1488
msgid ""
"\n"
"\n"
"This will enable the use of\n"
"`SSLSocketFactory.ALLOW\\_ALL\\_HOSTNAME\\_VERIFIER` as a result, host\n"
"name verification that should take place when establishing an SSL\n"
"connection is disabled and will lead to the same situation as all the\n"
"certificate is trusted.\n"
msgstr ""

#: vulnerabilities.py:1514 vulnerabilities.py:1515
msgid "App Extending WebViewClient"
msgstr ""

#: vulnerabilities.py:1516
msgid ""
"Does the application use WebViewClients correctly and handle the "
"onReceivedSSLError method?"
msgstr ""

#: vulnerabilities.py:1517
msgid ""
"Application seems to be handling WebViewClient correctly, or has no "
"implementation of WebViewClient."
msgstr ""

#: vulnerabilities.py:1518
msgid ""
"\n"
"You can make your provider private by specifying the `android:exported`\n"
"attribute in the `AndroidManifest.xml` file. From API Level 17 and later,\n"
"a content provider is private if you do not specify the attribute\n"
"explicitly. For example,\n"
"\n"
"    <provider android:exported=\"false\" android:name=\"MyContentProvider\"\n"
"    android:authorities=\"com.example.mycontentprovider\" />\n"
"\n"
"If you do not need to share a content provider with other applications,\n"
"it should be declared android:exported=\"false\" in the manifest file.\n"
"Note, however, in API Level 8 and earlier, even if you explicitly\n"
"declare `android:exported=\"false\"`, your content provider is accessible\n"
"from other apps.\n"
msgstr ""

#: vulnerabilities.py:1533
msgid ""
"\n"
"WebViews can introduce a number of security concerns and should be\n"
"implemented carefully. In particular, many vulnerabilities have been\n"
"discovered that exploit the use of the addJavscriptInterface API and\n"
"bypassing onReceivedSslError check.\n"
"\n"
"WebView does support SSL/TLS, however, the blank screen is an indication\n"
"that the WebView does not believe that the certificate is valid. This\n"
"may happen with a certificate that is self-signed or a from a root auth\n"
"that is not set up in android. However if that check is bypassed, then\n"
"it removes all security from SSL.\n"
msgstr ""

#: vulnerabilities.py:1545
msgid ""
"\n"
"The default handling of WebViewClient should handle the\n"
"onReceivedSSLError properly, which might break certificate validation\n"
msgstr ""

#: vulnerabilities.py:1557
msgid ""
"\n"
"This can be fixed by using the onReceivedSslError to stop or notify the\n"
"user and the application.\n"
"\n"
"    public void onReceivedSslError(WebView view, SslErrorHandler handler, "
"SslError error)  {\n"
"        //STOP OR ALERT THE USER\n"
"    }\n"
msgstr ""

#: vulnerabilities.py:1565
msgid ""
"\n"
"The following code shows how onReceivedSslError was used to bypass the\n"
"check in WebViewClient:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1588 vulnerabilities.py:1589
msgid "Unused Permissions"
msgstr ""

#: vulnerabilities.py:1590
msgid "Is the application over-privileged?"
msgstr ""

#: vulnerabilities.py:1591
msgid ""
"Application seems to have just the essential set of permissions required."
msgstr ""

#: vulnerabilities.py:1592
msgid ""
"\n"
"The following code shows how this could be exploited:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1596
msgid ""
"\n"
"An app might request a user for certain permissions, like access to SD\n"
"card, contacts, social profiles, etc. which has not actually been\n"
"invoked while the scan was running. We list out all these permissions so\n"
"that you can optimize your app and follow proper compliance checks.\n"
msgstr ""

#: vulnerabilities.py:1602
msgid ""
"\n"
"Application seems to be using extra permissions which are not really\n"
"needed\n"
msgstr ""

#: vulnerabilities.py:1606 vulnerabilities.py:1612
msgid ""
"\n"
"Users may not download your app when presented with a long list of\n"
"permissions. Imagine a flashlight app requesting access to SD card,\n"
"camera, contacts, SMS and more. This is an invitation to poor ratings\n"
"and reviews on App Stores. This also breaks compliance standards.\n"
msgstr ""

#: vulnerabilities.py:1618
msgid ""
"\n"
"Do not request for permissions beyond what your app actually needs\n"
msgstr ""

#: vulnerabilities.py:1631 vulnerabilities.py:1632
msgid "JavascriptInterface Remote Code Execution"
msgstr ""

#: vulnerabilities.py:1633
msgid ""
"Is the application using JavascriptInterface? Does the application "
"communicate over non-SSL or broken SSL Implementation?"
msgstr ""

#: vulnerabilities.py:1634
msgid ""
"Application is safe from remote code execution through JavascriptInterface."
msgstr ""

#: vulnerabilities.py:1635
msgid ""
"\n"
"The `android.util.Log` class allows a number of possibilities:\n"
"\n"
"- Log.d (Debug)\n"
"- Log.e (Error)\n"
"- Log.i (Info)\n"
"- Log.v (Verbose)\n"
"- Log.w (Warn)\n"
"\n"
msgstr ""

#: vulnerabilities.py:1645
msgid ""
"\n"
"For API level JELLY\\_BEAN or below, allowing an app to use the\n"
"addJavascriptInterface method with untrusted content in a WebView leaves\n"
"the app vulnerable to scripting attacks using reflection to access\n"
"public methods from JavaScript. Untrusted content examples include\n"
"content from any HTTP URL (as opposed to HTTPS) and user-provided\n"
"content. The method `addJavascriptInterface(Object, String)` is called\n"
"from the `android.webkit.WebView` class. Sensitive data and app control\n"
"should not be exposed to scripting attacks.\n"
msgstr ""

#: vulnerabilities.py:1655
msgid ""
"\n"
"Application seems to use `JavascriptInterface`. An attacker can use it to\n"
"do a Remote Code Execution on your application and steal sensitive\n"
"informations.\n"
msgstr ""

#: vulnerabilities.py:1660 vulnerabilities.py:1665
msgid ""
"\n"
"The app may be susceptible to JavaScript scripting attacks from\n"
"user-supplied content or content from HTTP causing loss of sensitive\n"
"information.\n"
msgstr ""

#: vulnerabilities.py:1670
msgid ""
"\n"
"-   Compliant code could refrain from calling the addJavascriptInterface() "
"method.\n"
"\n"
"        WebView webView = new WebView(this);\n"
"        setContentView(webView);\n"
"\n"
"-   Another compliant solution is to specify in the app's manifest that\n"
"    the app is only for API levels JELLY\\_BEAN\\_MR1 and above. For these\n"
"    API levels, only public methods that are annotated with\n"
"    JavascriptInterface can be accessed from JavaScript. API level 17\n"
"    is JELLY\\_BEAN\\_MR1.\n"
"\n"
msgstr ""

#: vulnerabilities.py:1683
msgid ""
"\n"
"This non-compliant code example shows an application that calls the\n"
"`addJavascriptInterface()` method, and hence is not secure for API level\n"
"JELLY\\_BEAN and lower.\n"
"\n"
msgstr ""

#: vulnerabilities.py:1688
msgid ""
"\n"
"\n"
"JavaScript can now control the host. Java reflection could be used to\n"
"access any of the public methods of an injected object, using the\n"
"permissions of the app.\n"
msgstr ""

#: vulnerabilities.py:1703 vulnerabilities.py:1704
msgid "Unprotected Activities"
msgstr ""

#: vulnerabilities.py:1705
msgid "Are application activities protected?"
msgstr ""

#: vulnerabilities.py:1706
msgid "Activities seem to be sufficiently protected."
msgstr ""

#: vulnerabilities.py:1711
msgid ""
"\n"
"On Android, declaring an intent filter for an activity in the\n"
"`AndroidManifest.xml` file means that the activity may be exported to\n"
"other apps. If the activity is intended solely for the internal use of\n"
"the app and an intent filter is declared, then any other apps, including\n"
"malware, can activate the activity for unintended use.\n"
"\n"
"In the case of the vulnerability in the Twicca app (in versions 0.7.0\n"
"through 0.9.30), by launching Twicca's activity, another app that does\n"
"not have permission to access the SD card or network could upload images\n"
"or movies stored on the SD card to a social networking service with the\n"
"Twicca user's Twitter account.\n"
msgstr ""

#: vulnerabilities.py:1724
msgid ""
"\n"
"An activity was found to be shared with other apps on the device without\n"
"an intent filter or a permission requirement, therefore leaving it\n"
"accessible to any other application on the device.\n"
msgstr ""

#: vulnerabilities.py:1729 vulnerabilities.py:1733
msgid ""
"\n"
"Unauthorized apps may use vulnerable activities to perform malicious\n"
"actions.\n"
msgstr ""

#: vulnerabilities.py:1737
msgid ""
"\n"
"-   In this compliant solution the activity is not exported:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1740
msgid ""
"\n"
"\n"
"    By declaring android:exported=\"false\" for an activity tag in the\n"
"    AndroidManifest.xml file, the activity is restricted to only accept\n"
"    intents from within the same app or from an app with the same\n"
"    user ID.\n"
"\n"
"-   This vulnerability was fixed in Twicca v0.9.31. Instead of declaring\n"
"    the activity exported=\"false\" in AndroidManifest.xml, Twicca fixed\n"
"    this vulnerability by validating the caller of this activity. In\n"
"    the onCreate() method of the activity class, code was added to check\n"
"    if the package name of the caller is the same as the package name\n"
"    of itself. If the package names are different, the activity exits:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1754
msgid ""
"\n"
"\n"
"    An Android developer can arbitrarily choose a package name, so\n"
"    different app developers could choose the same package name.\n"
"    Therefore, it is generally not recommended to use the package name\n"
"    for validating the caller of the activity. The recommended\n"
"    alternative is to check the developer's certificate, instead of the\n"
"    package name.\n"
"\n"
"    However, considering the following facts, Twicca's solution may be\n"
"    logical and safe against the exploit:\n"
"\n"
"    - Only one app with a particular package name can exist on\n"
"      Google Play.\n"
"\n"
"    - If a user tries to install an app whose package name already\n"
"      exists on the device, the installation either will fail or will\n"
"      overwrite the previously installed app.\n"
"\n"
msgstr ""

#: vulnerabilities.py:1774
msgid ""
"\n"
"This non-compliant code example shows an `AndroidManifest.xml` file for an\n"
"application that exports the activity to other apps, but does not\n"
"restrict access to its sensitive activity:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1779
msgid ""
"\n"
"\n"
"`android:name` refers to the name of the class that implements this\n"
"activity. The name of the package is `jp.co.vulnerable` so the fully\n"
"qualified name of the class implementing this activity is\n"
"`jp.co.vulnerable.media.yfrog.YfrogUploadDialog`. Since the intent filter\n"
"is defined, this activity is exported to other apps.\n"
msgstr ""

#: vulnerabilities.py:1787
msgid ""
"\n"
"- [JVN\\#31860555](https://jvn.jp/en/jp/JVN31860555/) Twicca fails to\n"
"  restrict access permissions\n"
"\n"
msgstr ""

#: vulnerabilities.py:1801 vulnerabilities.py:1802
msgid "SQL Injection"
msgstr ""

#: vulnerabilities.py:1803
msgid "Is the application vulnerable to SQL Injection through Web API?"
msgstr ""

#: vulnerabilities.py:1804
msgid "Application is not vulnerable to SQL Injection through Web API."
msgstr ""

#: vulnerabilities.py:1805
msgid ""
"\n"
"Declare READ\\_LOGS permission in the manifest file so that an app can\n"
"read log output:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1809
msgid ""
"\n"
"\n"
"Prior to Android 4.0, any application with READ\\_LOGS permission could\n"
"obtain all the other applications' log output. After Android 4.1, the\n"
"specification of READ\\_LOGS permission has been changed. Even\n"
"applications with READ\\_LOGS permission cannot obtain log output from\n"
"other applications.\n"
"\n"
"However, by connecting an Android device to a PC, log output from other\n"
"applications can be obtained.\n"
"\n"
"Therefore, it is important that applications do not send sensitive\n"
"information to log output.\n"
msgstr ""

#: vulnerabilities.py:1823
msgid ""
"\n"
"An SQL injection vulnerability arises when the original SQL query can be\n"
"altered to form an altogether different query. Execution of this altered\n"
"query may result in information leaks or data modification. The primary\n"
"means of preventing SQL injection are validating and sanitizing user\n"
"input, and parameterizing the query.\n"
msgstr ""

#: vulnerabilities.py:1830
msgid ""
"\n"
"Data retrieved from a mobile app's server contains malformed data that\n"
"results in a SQL injection within the mobile device's local databases.\n"
"Local SQL injections may result in local malware injection, information\n"
"theft, and more\n"
msgstr ""

#: vulnerabilities.py:1836 vulnerabilities.py:1842
msgid ""
"\n"
"SQL injection allows the intruder to view and modify data contained in\n"
"the database. The attacker could also gain much higher privileges over\n"
"the database over time thus compromising the confidentiality and\n"
"integrity of the data stored.\n"
msgstr ""

#: vulnerabilities.py:1848
msgid ""
"\n"
"Input validation is a prerequisite for proper query construction. This\n"
"compliant solution validates the length of the username and password\n"
"arguments. It also uses a java.sql.PreparedStatement instead of\n"
"java.sql.Statement.\n"
"\n"
msgstr ""

#: vulnerabilities.py:1855
msgid ""
"\n"
"This non-compliant code example shows JDBC code that is vulnerable to\n"
"SQL injection. The SQL statement SQL accepts unsanitized input\n"
"arguments.\n"
"\n"
msgstr ""

#: vulnerabilities.py:1860
msgid ""
"\n"
"\n"
"If the attacker enters a valid user name securecoding and enters 'OR\n"
"username = 'securecoding for the password argument, the SQL statement\n"
"evaluates to select \\* from db\\_user where username = '' OR username =\n"
"'securecoding' and password='', consequently bypassing the login\n"
"password check. Similarly, an input ofsomeuser' OR '1' = '1 would bypass\n"
"both the user name and password checks, granting the attacker\n"
"unrestricted access.\n"
msgstr ""

#: vulnerabilities.py:1879 vulnerabilities.py:1880
msgid "Storing Information in Shared Preferences"
msgstr ""

#: vulnerabilities.py:1881
msgid "Is any sensitive information is leaking through Shared Preferences?"
msgstr ""

#: vulnerabilities.py:1882
msgid "No leakage of data were found via Shared Preference."
msgstr ""

#: vulnerabilities.py:1883
msgid ""
"\n"
"Example code of obtaining log output from a vulnerable application is as\n"
"follows:\n"
"\n"
msgstr ""

#: vulnerabilities.py:1888
msgid ""
"\n"
"In Android apps, data can be communicated via intents, or data can be\n"
"written to files, distributed using shared references, or stored in\n"
"databases. In all these cases, if the data is sensitive, it is important\n"
"to keep the data secure. That is, it should not be possible for other\n"
"apps (or, more strictly, apps with different userids) to be able to\n"
"access this data, or for the data to be accessible to other programs or\n"
"people, if the data owner does not intend that.\n"
"\n"
"Data security (for non-intent communication channels) can be supported\n"
"by creating the file, shared preference or database with MODE\\_PRIVATE\n"
"on internal storage or with MODE\\_PRIVATE and encrypted (using secure\n"
"encryption techniques, and using an encryption key only secure\n"
"parties/apps have) on external storage. MODE\\_PRIVATE is a constant\n"
"defined by the class android.content.Context. It may be used as the mode\n"
"parameter in the methods openFileOutput(), getSharedPreferences(),\n"
"andopenOrCreateDatabase() (which are all also defined in the class\n"
"android.content.Context).\n"
"\n"
"Static taint flow analysis can be done for a set of apps, to trace data\n"
"from each source (an input of data which cannot be fully predicted by\n"
"static analysis, e.g., text input by a user) to reachable sinks (data\n"
"output to a location that other applications or methods can access,\n"
"e.g., sending the data over a Bluetooth connection). Taint flow analysis\n"
"helps users understand many possible source to sink flows, including\n"
"flows that include intents and/or static fields.\n"
msgstr ""

#: vulnerabilities.py:1915
msgid ""
"\n"
"Insecured informations were found in shared preference. One shouldn't\n"
"use un-encrypted information in SharedPreference.\n"
msgstr ""

#: vulnerabilities.py:1919 vulnerabilities.py:1928
msgid ""
"\n"
"Typically, malicious code steals sensitive information (passwords,\n"
"session cookies, personally identifiable information, etc). Hence, the\n"
"associated business impacts include:\n"
"\n"
"- Fraud\n"
"- Privacy Violations\n"
"\n"
msgstr ""

#: vulnerabilities.py:1937
msgid ""
"\n"
"In this compliant solution the file is created using MODE\\_PRIVATE, so\n"
"it can be accessed only by the app that created the file.\n"
"\n"
"    openFileOutput(\"someFile\", MODE_PRIVATE);\n"
msgstr ""

#: vulnerabilities.py:1943
msgid ""
"\n"
"This non-compliant code example shows an application that creates a file\n"
"that is world readable, and hence not secure.\n"
"\n"
"    openFileOutput(\"someFile\", MODE_WORLD_READABLE);\n"
"\n"
"Any application could read the file and access any data stored in it.\n"
msgstr ""

#: vulnerabilities.py:1960 vulnerabilities.py:1961 vulnerabilities.py:4373
#: vulnerabilities.py:4374
msgid "Insufficient Transport Layer Protection"
msgstr ""

#: vulnerabilities.py:1962
msgid ""
"Is your application using proper Transport Layer protection? Is HTTPS "
"enabled in your application?"
msgstr ""

#: vulnerabilities.py:1963
msgid ""
"Application seems to have SSL enabled and sufficient protection is being "
"used to prevent Information leakage."
msgstr ""

#: vulnerabilities.py:1974 vulnerabilities.py:4378
msgid ""
"\n"
"Insufficient transport layer protection issues happen when the data is\n"
"sent from the mobile app to the server over unsecured channels. Whether\n"
"the data is transmitted through the carrier network or through WiFi, it\n"
"will end up through the Internet either way before it could reach the\n"
"remote server. There are several ways where unprotected data transmitted\n"
"over the network could be sniffed; things like routers, proxies, cell\n"
"towers, are some of the few ways data could be sniffed while in transit.\n"
msgstr ""

#: vulnerabilities.py:1983 vulnerabilities.py:4387
msgid ""
"\n"
"Insufficient transport layer protection issues happen when the data is\n"
"sent from the mobile app to the server over unsecure channels. Whether\n"
"the data is transmitted through the carrier network or through WiFi, it\n"
"will end up through the Internet either way before it could reach the\n"
"remote server. There are several ways where unprotected data transmitted\n"
"over the network could be sniffed; things like routers, proxies, cell\n"
"towers, are some of the few ways data could be sniffed while in transit.\n"
msgstr ""

#: vulnerabilities.py:1992 vulnerabilities.py:2000 vulnerabilities.py:4396
#: vulnerabilities.py:4404
msgid ""
"\n"
"The violation of a user's confidentiality may result in:\n"
"\n"
"- Identity theft\n"
"- Fraud\n"
"- Reputational Damage\n"
"\n"
msgstr ""

#: vulnerabilities.py:2008
msgid ""
"\n"
"Never use HTTP URL to download data. Instead, create a valid HTTPS\n"
"request through which only sensitive data can be downloaded.\n"
msgstr ""

#: vulnerabilities.py:2012
msgid ""
"\n"
"Using HTTP with SSL or TLS to connect to internet, or without a proper\n"
"certificate the connection can be easily eavesdropped by attacker\n"
"without the knowledge of the user.\n"
"\n"
msgstr ""

#: vulnerabilities.py:2017
msgid ""
"\n"
"\n"
"An attacker can perform a MITM attack and the user wouldn't even know\n"
"that someone is eavesdropping the connection.\n"
msgstr ""

#: vulnerabilities.py:2031 vulnerabilities.py:2032
msgid "Derived Crypto Keys"
msgstr ""

#: vulnerabilities.py:2033
msgid "Does the application use insecure encryption methods?"
msgstr ""

#: vulnerabilities.py:2034
msgid ""
"Application seems to be using the correct cryptographic encryption method, "
"if any."
msgstr ""

#: vulnerabilities.py:2035
msgid ""
"\n"
"- Assume that the network layer is not secure and may potentially be\n"
"  hostile and eavesdropping.\n"
"- Enforce the use of SSL/TLS for all transport channels in which\n"
"  sensitive information, session tokens, or other sensitive data is\n"
"  going to be communicated to a backend API or web service.\n"
"- Remember to account for outside entities like third-party analytics,\n"
"  social networks, etc. and use their SSL versions even when an\n"
"  application runs a routine via the browser/webkit. Mixed SSL\n"
"  sessions should be avoided and may expose the user's session ID.\n"
"- Use strong, industry standard encryption algorithms and appropriate\n"
"  key lengths.\n"
"- Use certificates signed by a trusted CA provider.\n"
"- Never allow self-signed certificates, and consider certificate\n"
"  pinning for security conscious applications.\n"
"- Do not disable or ignore SSL chain verification.\n"
"- Only establish a secure connection after verifying the identity of\n"
"  the endpoint server with trusted certificates in the key chain.\n"
"- Alert users through the UI if an invalid certificate is detected.\n"
"- Do not send sensitive data over alternate channels, such as SMS,\n"
"  MMS, or notifications.\n"
"\n"
msgstr ""

#: vulnerabilities.py:2058
#, python-format
msgid ""
"\n"
"The predominant Android cryptographic security provider API defaults to\n"
"using an insecure AES encryption method: ECB block cipher mode for AES\n"
"encryption. Android's default cryptographic security provider (since\n"
"version 2.1) is BouncyCastle.\n"
"\n"
"NOTE: Java also chose ECB as a default value when only the AES\n"
"encryption method is chosen. So, this rule also applies to Java, but for\n"
"Java's different default cryptographic security provider. Oracle Java's\n"
"default cryptographic security provider is SunJCE.\n"
"\n"
"Default behaviors of cryptographic libraries used in Android systems\n"
"often do not use recommended practices. For example, the predominant\n"
"Android Java security provider API defaults to using an insecure AES\n"
"encryption method: ECB block cipher mode for AES encryption. Extensive\n"
"app testing by \\[Egele 2013\\] has shown that the following 6 rules are\n"
"often not followed, resulting in 88% of apps with cryptographic APIs on\n"
"Google Play making at least one mistake.\n"
"\n"
"Six common cryptography rules they tested:\n"
"\n"
"1.  Do not use ECB mode for encryption.\n"
"2.  Do not use a non-random IV for CBC encryption.\n"
"3.  Do not use constant encryption keys.\n"
"4.  Do not use constant salts for PBE.\n"
"5.  Do not use fewer than 1,000 iterations for PBE.\n"
"6.  Do not use static seeds to seed SecureRandom(·).\n"
"\n"
msgstr ""

#: vulnerabilities.py:2087
msgid ""
"\n"
"Traces of Crypto Keys which might be intermediate keys used when loading\n"
"the different libraries.\n"
msgstr ""

#: vulnerabilities.py:2091 vulnerabilities.py:2101
msgid ""
"\n"
"Broken cryptography will result in the following:\n"
"\n"
"- Privacy Violations\n"
"- Information Theft\n"
"- Code Theft\n"
"- Intellectual Property Theft\n"
"- Reputational Damage\n"
"\n"
msgstr ""

#: vulnerabilities.py:2111
msgid ""
"\n"
"The following are the rules which should be followed while using\n"
"encryption\n"
"\n"
"- If AES encryption is used, always pair it with CBC (Cipher Block "
"Chaining)\n"
"- Never use just AES as encryption because it defaults to AES/ECB "
"(Electronic Codebook)\n"
"- Always use padding with the encryption, for example, AES/CBC/PKCS7\n"
"  is stronger than just AES/CBC\n"
"- Never use older algorithim like DES (Data Encryption Standard)\n"
"\n"
msgstr ""

#: vulnerabilities.py:2132 vulnerabilities.py:2133
msgid "Application Logs"
msgstr ""

#: vulnerabilities.py:2134
msgid "Is this application leaking data through logs?"
msgstr ""

#: vulnerabilities.py:2135
msgid "No application logs were found."
msgstr ""

#: vulnerabilities.py:2137
msgid ""
"\n"
"Android provides capabilities for an app to output logging information\n"
"and obtain log output. Applications can send information to log output\n"
"using the android.util.Log class. To obtain log output, applications can\n"
"execute the logcat command.\n"
msgstr ""

#: vulnerabilities.py:2143
msgid ""
"\n"
"Application was found to be writing logs to the system logs\n"
msgstr ""

#: vulnerabilities.py:2146 vulnerabilities.py:2150 vulnerabilities.py:2321
#: vulnerabilities.py:2325
msgid ""
"\n"
"Sensitive data can inadvertently leak into the logs and may aid in\n"
"further attacks\n"
msgstr ""

#: vulnerabilities.py:2154
msgid ""
"\n"
"Never use logs in production\n"
"\n"
msgstr ""

#: vulnerabilities.py:2157
msgid ""
"\n"
"\n"
"Use exception parsers and crash-based-analytics tool capture crashes in\n"
"production so that it can be debugged\n"
msgstr ""

#: vulnerabilities.py:2162
msgid ""
"\n"
"\n"
"    If a user is using Android OS 4.0 or before, other applications with\n"
"    READ\\_LOGS permission can obtain the user's location information\n"
"    without declaring ACCESS\\_FINE\\_LOCATION permission in the\n"
"    manifest file.\n"
msgstr ""

#: vulnerabilities.py:2169
msgid ""
"\n"
"- Facebook SDK for Android:\n"
"  <http://readwrite.com/2012/04/10/what-developers-and-users-"
"can#awesm=~o9iqZAMlUPshPu>\n"
"- [JVN\\#23328321](https://jvn.jp/en/jp/JVN23328321/) Puella Magi\n"
"  Madoka Magica iP for Android vulnerable to information disclosure\n"
"- [JVN\\#86040029](https://jvn.jp/en/jp/JVN86040029/) Weathernews Touch\n"
"  for Android stores location information in the system log file\n"
"- [JVN\\#33159152](https://jvn.jp/en/jp/JVN33159152/) Loctouch for\n"
"  Android information management vulnerability\n"
"- [JVN\\#56923652](https://jvn.jp/en/jp/JVN56923652/) Monaca Debugger\n"
"  for Android information management vulnerability\n"
"\n"
msgstr ""

#: vulnerabilities.py:2190 vulnerabilities.py:2191 vulnerabilities.py:2268
#: vulnerabilities.py:2269
msgid "Business Logic"
msgstr ""

#: vulnerabilities.py:2192 vulnerabilities.py:2270
msgid "Were flaws found in the business logic?"
msgstr ""

#: vulnerabilities.py:2193 vulnerabilities.py:2271
msgid "No flaws were found in the business logic."
msgstr ""

#: vulnerabilities.py:2195
msgid ""
"\n"
"Most security problems are weaknesses in an application that result from\n"
"a broken or missing security control (authentication, access control,\n"
"input validation, etc...). By contrast, business logic vulnerabilities\n"
"are ways of using the legitimate processing flow of an application in a\n"
"way that results in a negative consequence to the organization.\n"
"\n"
"Too often, the business logic category is used for vulnerabilities that\n"
"can't be scanned for automatically. This makes it very difficult to\n"
"apply any kind of categorization scheme. Business logic problems are\n"
"different from authentication problems and every other category. There\n"
"are many significant business logic vulnerabilities, but they are far\n"
"less common than the type of items.\n"
msgstr ""

#: vulnerabilities.py:2209
msgid ""
"\n"
"Logical Flaws through API which can bypass authorization and get\n"
"information about other users. Authorization and\n"
"authenticated sessions were not properly validated on both client or\n"
"server side\n"
msgstr ""

#: vulnerabilities.py:2217
msgid ""
"\n"
"The following should be checked and properly fixed\n"
"\n"
"- Check for OTP in server side rather than in Client Side\n"
"- Use proper Authentication not same authorization token like\n"
"  Authorization: Basic aW50ZXJhY3Rpb25vbmU6bW9iaTEyMw== which\n"
"  translates to: interactionone:mobi123\n"
"- never use passwords like mobi123\n"
"\n"
msgstr ""

#: vulnerabilities.py:2228
msgid ""
"\n"
"Automated tools find it hard to understand context, hence it's up to a\n"
"person to perform these kinds of tests. The following two examples will\n"
"illustrate how understanding the functionality of the application, the\n"
"developer's intentions, and some creative \"out-of-the-box\" thinking can\n"
"break the application's logic. The first example starts with a\n"
"simplistic parameter manipulation, whereas the second is a real world\n"
"example of a multi-step process leading to completely subvert the\n"
"application.\n"
"\n"
"Example 1:\n"
"\n"
"Suppose an e-commerce site allows users to select items to purchase,\n"
"view a summary page and then tender the sale. What if an attacker was\n"
"able to go back to the summary page, maintaining their same valid\n"
"session and inject a lower cost for an item and complete the\n"
"transaction, and then check out?\n"
"\n"
"Example 2:\n"
"\n"
"Holding/locking resources and keeping others from purchases these items\n"
"online may result in attackers purchasing items at a lower price. The\n"
"countermeasure to this problem is to implement timeouts and mechanisms\n"
"to ensure that only the correct price can be charged.\n"
"\n"
"Example 3:\n"
"\n"
"What if a user was able to start a transaction linked to their\n"
"club/loyalty account and then after points have been added to their\n"
"account cancel out of the transaction? Will the points/credits still be\n"
"applied to their account?\n"
msgstr ""

#: vulnerabilities.py:2273
msgid ""
"\n"
"Most security problems are weaknesses in an application that result from\n"
"a broken or missing security control (authentication, access control,\n"
"input validation, etc.). By contrast, business logic vulnerabilities are\n"
"ways of using the legitimate processing flow of an application in a way\n"
"that results in a negative consequence to the organization.\n"
"\n"
"Too often, the business logic category is used for vulnerabilities that\n"
"can't be scanned for automatically. This makes it very difficult to\n"
"apply any kind of categorization scheme. Business logic problems are\n"
"different from authentication problems and every other category. There\n"
"are many signficant business logic vulnerabilities, but they are far\n"
"less common than the type of items.\n"
msgstr ""

#: vulnerabilities.py:2287
msgid ""
"\n"
"Logical Flaws through API which can bypass Authorization and get\n"
"information about other users. Authorization and\n"
"authenticated sessions were not properly validated on both client or\n"
"server side\n"
msgstr ""

#: vulnerabilities.py:2306 vulnerabilities.py:2307
msgid "Debug Logging with NSLog"
msgstr ""

#: vulnerabilities.py:2308
msgid "Is the application logging to the system logs?"
msgstr ""

#: vulnerabilities.py:2309
msgid "Application does not log to system logs."
msgstr ""

#: vulnerabilities.py:2311
msgid ""
"\n"
"Applications tend to add some data in logs for debugging purpose. If\n"
"sensitive data is shown in the application logs then it may lead to\n"
"leakage of data.\n"
msgstr ""

#: vulnerabilities.py:2316
msgid ""
"\n"
"Debug Logs are usually left enabled during application development.\n"
"These application logs are easily accessible via XCode or by root access\n"
"to the device.\n"
msgstr ""

#: vulnerabilities.py:2329
msgid ""
"\n"
"Wipe off the application log at particular intervals or when the user\n"
"signs out of the application. Do not log any sensitive information.\n"
msgstr ""

#: vulnerabilities.py:2343 vulnerabilities.py:2344
msgid "Sensitive Information in Property Lists"
msgstr ""

#: vulnerabilities.py:2345
msgid ""
"Does the application store sensitive information in Property Lists (plist)?"
msgstr ""

#: vulnerabilities.py:2346
msgid "The application does not store sensitive information in Property Lists."
msgstr ""

#: vulnerabilities.py:2348
msgid ""
"\n"
"Information Property List Files are the files that contain configuration\n"
"information about the application executable. These files are stored in\n"
"unencrypted form on the device & hence, can be read by anyone by\n"
"accessing the application sandbox via any third-party tools (up to iOS\n"
"v8.2), by gaining root access to the device (after v8.2) or by taking an\n"
"iOS backup.\n"
msgstr ""

#: vulnerabilities.py:2356
msgid ""
"\n"
"Plist files contain data in plaintext format\n"
msgstr ""

#: vulnerabilities.py:2359 vulnerabilities.py:2363
msgid ""
"\n"
"An attacker can steal sensitive data if they have access to the device\n"
"or device backup\n"
msgstr ""

#: vulnerabilities.py:2367
msgid ""
"\n"
"It's recommended not to store any sensitive data such as usernames,\n"
"authentication tokens, passwords, personal information in any of the\n"
"plist files of the application.\n"
msgstr ""

#: vulnerabilities.py:2382 vulnerabilities.py:2383
msgid "Sensitive Data in NSUserDefaults"
msgstr ""

#: vulnerabilities.py:2384
msgid "Does this application store sensitive information in NSUserDefaults?"
msgstr ""

#: vulnerabilities.py:2385
msgid ""
"This application does not store sensitive information in NSUserDefaults."
msgstr ""

#: vulnerabilities.py:2387
msgid ""
"\n"
"NSUserDefaults are stored in plist in binary format, with no encryption,\n"
"and is stored in your app's directory. Any user can edit, see, share,\n"
"move and whatever they want to. Thus, if any sensitive information is\n"
"stored in NSUserDefaults then it may reach wrong hands & can be used for\n"
"personal use later on.\n"
msgstr ""

#: vulnerabilities.py:2394
msgid ""
"\n"
"NSUserDefaults is an alternative way by which data can be stored in\n"
"Plist files\n"
msgstr ""

#: vulnerabilities.py:2398 vulnerabilities.py:2402
msgid ""
"\n"
"Sensitive information can get compromised since plist files store data\n"
"unencrypted.\n"
msgstr ""

#: vulnerabilities.py:2406
msgid ""
"\n"
"Avoid using NSUserDefaults to store sensitive pieces of information as\n"
"it stores data in plist files which contain information in unencrypted\n"
"form.\n"
msgstr ""

#: vulnerabilities.py:2421 vulnerabilities.py:2422
msgid "Sensitive Information in SQLite3 Databases"
msgstr ""

#: vulnerabilities.py:2423
msgid "Does this application store sensitive information in SQLite3 databases?"
msgstr ""

#: vulnerabilities.py:2424
msgid ""
"This application does not store sensitive information in SQLite3 databases."
msgstr ""

#: vulnerabilities.py:2426
msgid ""
"\n"
"SQLite databases are often used by the applications to store persistent\n"
"or temporary data which can be further used by the application at later\n"
"stages. For example, in order to provide seamless experience to the\n"
"user, an application may store user credentials in SQLite database so\n"
"that the user doesn't need to enter them again later on. However, these\n"
"databases don't have any built-in support for encryption and hence, all\n"
"the information is stored in plain-text format in these files.\n"
msgstr ""

#: vulnerabilities.py:2435
msgid ""
"\n"
"SQLite3 databases are stored in unencrypted form on the device. Storing\n"
"sensitive information in such databases may lead to leakage of data.\n"
msgstr ""

#: vulnerabilities.py:2439 vulnerabilities.py:2443 vulnerabilities.py:2484
#: vulnerabilities.py:2488 vulnerabilities.py:2531 vulnerabilities.py:2535
#: vulnerabilities.py:2591 vulnerabilities.py:2595 vulnerabilities.py:2637
#: vulnerabilities.py:2641
msgid ""
"\n"
"Failure to use encryption routines may result in the database and its\n"
"associated data including user credentials getting compromised.\n"
msgstr ""

#: vulnerabilities.py:2447
msgid ""
"\n"
"It is suggested to use custom encryption while storing data in SQLite\n"
"databases.\n"
"\n"
"SQLite engine writes the data into Write Ahead Log (WAL) before storing\n"
"it in the actual database file. Using WAL, there is a possibility to\n"
"recover the deleted data from the database file. Hence, before deleting\n"
"any SQLite record, always overwrite it with some junk data so that it\n"
"can't be read even if someone tries to recover it.\n"
msgstr ""

#: vulnerabilities.py:2467 vulnerabilities.py:2468
msgid "Unsecured Data in CoreData"
msgstr ""

#: vulnerabilities.py:2469
msgid "Does this application store sensitive information in CoreData?"
msgstr ""

#: vulnerabilities.py:2470
msgid "This application does not store sensitive information in CoreData."
msgstr ""

#: vulnerabilities.py:2472
msgid ""
"\n"
"Core Data is used by the applications to store data which can be further\n"
"used by the application at later stages. However, these databases don't\n"
"have any built-in support for encryption and hence, all the information\n"
"is stored in plain-text format in these files. If an application stores\n"
"user credentials or some sensitive user specific data in this database\n"
"then it can be accessed by any third party.\n"
msgstr ""

#: vulnerabilities.py:2480
msgid ""
"\n"
"Core Data is often used by applications to store data to improve\n"
"application performance\n"
msgstr ""

#: vulnerabilities.py:2492
msgid ""
"\n"
"It is suggested to use custom encryption while storing data in Core\n"
"Data.\n"
"\n"
"EncryptedStore is known to work successfully on iOS versions 6.0 through\n"
"9.3.4 to store CoreData in encrypted format\n"
"\n"
"If you wish to set a custom cache size and/or custom database URL:\n"
"create an NSDictionary to set the options for your EncryptedStore,\n"
"replacing customPasscode, customCacheSize, and/or customDatabaseURL:\n"
"\n"
msgstr ""

#: vulnerabilities.py:2514 vulnerabilities.py:2515
msgid "Unsecured Data in CouchDB"
msgstr ""

#: vulnerabilities.py:2516
msgid "Does this application store data in CouchDB?"
msgstr ""

#: vulnerabilities.py:2517
msgid "This application does not store sensitive information in CouchDB."
msgstr ""

#: vulnerabilities.py:2519
msgid ""
"\n"
"Couch databases are used by the applications to store data which can be\n"
"further used by the application at later stages. However, these\n"
"databases don't have any built-in support for encryption and hence, all\n"
"the information is stored in plain-text format in these files. If an\n"
"application stores user credentials or some sensitive user specific data\n"
"in this database then it can be accessed by any third party.\n"
msgstr ""

#: vulnerabilities.py:2527
msgid ""
"\n"
"CouchDB is an alternative to SQLite3 database, used by applications to\n"
"store data\n"
msgstr ""

#: vulnerabilities.py:2539
msgid ""
"\n"
"It is suggested to use custom encryption while storing data in Couch\n"
"Database.\n"
"\n"
"Database encryption is available for both ForestDB and SQLite storage\n"
"types. It is automatically hooked into ForestDB's filesystem abstraction\n"
"layer and for SQLite storage, Couchbase Lite uses SQLCipher; an open\n"
"source extension to SQLite that provides transparent encryption of\n"
"database files. In both cases, the encryption specification is 256-bit\n"
"AES.\n"
"\n"
"SQLCipher is an optional dependency. The section below describes how to\n"
"add it to platform.\n"
"\n"
"- Download the iOS SDK from\n"
"  <http://www.couchbase.com/nosql-databases/downloads#couchbase-mobile>.\n"
"- Add the libsqlcipher.a library to your XCode project.\n"
"- Go to the Link Binary With Libraries build phase of your app target.\n"
"- Remove libsqlite.dylib\n"
"\n"
msgstr ""

#: vulnerabilities.py:2570 vulnerabilities.py:2571
msgid "Unsecured Data in RealmDB"
msgstr ""

#: vulnerabilities.py:2572 vulnerabilities.py:2622
msgid "Does this application store data in RealmDB?"
msgstr ""

#: vulnerabilities.py:2573
msgid "This application does not store sensitive information in RealmDB."
msgstr ""

#: vulnerabilities.py:2575
msgid ""
"\n"
"Realm databases are used by the applications to store data which can be\n"
"further used by the application at later stages. However, these\n"
"databases don't have any built-in support for encryption and hence, all\n"
"the information is stored in plain-text format in these files. If an\n"
"application stores user credentials or some sensitive user specific data\n"
"in this database then it can be accessed by any third party.\n"
msgstr ""

#: vulnerabilities.py:2583
msgid ""
"\n"
"Realm databases are used by the applications to store data which can be\n"
"further used by the application at later stages. However, these\n"
"databases do not have any built-in support for encryption and hence, all\n"
"the information is stored in plaintext format in these files. If an\n"
"application stores user credentials or some sensitive user specific data\n"
"in this database then it can be accessed by any third party.\n"
msgstr ""

#: vulnerabilities.py:2599
msgid ""
"\n"
"It is suggested to use custom encryption while storing data in Realm\n"
"databases.\n"
"\n"
"An encrypted copy of the unencrypted Realm file, which can be done by\n"
"using\n"
"\n"
msgstr ""

#: vulnerabilities.py:2606
msgid ""
"\n"
"\n"
"and then can use the encrypted file at the new location.\n"
msgstr ""

#: vulnerabilities.py:2620 vulnerabilities.py:2621
msgid "Unsecured Data in YapDB"
msgstr ""

#: vulnerabilities.py:2623
msgid "This application does not store sensitive information in YapDB."
msgstr ""

#: vulnerabilities.py:2625
msgid ""
"\n"
"Yap databases are used by the applications to store data which can be\n"
"further used by the application at later stages. However, these\n"
"databases don't have any built-in support for encryption and hence, all\n"
"the information is stored in plain-text format in these files. If an\n"
"application stores user credentials or some sensitive user specific data\n"
"in this database then it can be accessed by any third party.\n"
msgstr ""

#: vulnerabilities.py:2633
msgid ""
"\n"
"YapDB is an alternative to SQLite3 database, used by applications to\n"
"store data\n"
msgstr ""

#: vulnerabilities.py:2645
msgid ""
"\n"
"It is suggested to use custom encryption while storing data in Yap\n"
"databases.\n"
"\n"
"SQLCipher is a SQLite extension that transparently encrypts the entire\n"
"database, and is available under a BSD-style license. SQLCipher support\n"
"has been added as a Cocoapod subspec. Simply change your Podfile:\n"
"\n"
"```\n"
"pod 'YapDatabase/SQLCipher'\n"
"```\n"
"\n"
"If you aren't using the SQLCipher subspec, the project won't compile the\n"
"encryption configuration options to prevent the case of accidentally\n"
"trying to use encryption when support is not available.\n"
"\n"
"Once the project is configured to use SQLCipher, it then needs to tell\n"
"YapDatabase the passphrase. This is done by setting the cipherKeyBlock\n"
"of YapDatabaseOptions.\n"
"\n"
msgstr ""

#: vulnerabilities.py:2665
msgid ""
"\n"
"\n"
"The cipherKeyBlock helps prevent storing the credentials in memory any\n"
"longer than necessary. This block will be executed on database setup,\n"
"and when new connections are made to the database.\n"
msgstr ""

#: vulnerabilities.py:2681 vulnerabilities.py:2682
msgid "Deprecated NSURLConnection"
msgstr ""

#: vulnerabilities.py:2683
msgid "Does this application use NSURLConnection?"
msgstr ""

#: vulnerabilities.py:2684
msgid "This application does not use NSURLConnection to connect over Internet."
msgstr ""

#: vulnerabilities.py:2686
msgid ""
"\n"
"`NSURLConnection` is the most common API used for establishing network\n"
"connections with the server. However, it has been replaced by\n"
"`NSURLSession` & deprecated by Apple starting iOS 9.0. `NSURLSession`\n"
"provides support for configuring per-session cache, protocol, cookie,\n"
"and credential policies, rather than sharing them across the app which\n"
"handles authentication challenge in a more appropriate way.\n"
msgstr ""

#: vulnerabilities.py:2694
msgid ""
"\n"
"`NSURLConnection` is the most common API used for establishing network\n"
"connections with the server. However, it has been replaced by\n"
"`NSURLSession` & deprecated by Apple starting iOS 9.0\n"
msgstr ""

#: vulnerabilities.py:2699 vulnerabilities.py:2706
msgid ""
"\n"
"Using deprecated routines may potentially result in:\n"
"\n"
"- Programming errors due to fatal flaws in deprecated methods.\n"
"- Data corruption due to unsafe deprecated methods.\n"
"\n"
msgstr ""

#: vulnerabilities.py:2713
msgid ""
"\n"
"It is advisable to use `NSURLSession` for all types of network connections\n"
"instead of `NSURLConnection` because Apple can stop supporting\n"
"`NSURLConnection` anytime in near future.\n"
"\n"
"`NSURLSession` is the key object responsible for sending and receiving\n"
"HTTP requests. It can be created via `NSURLSessionConfiguration`, which\n"
"comes in three flavors:\n"
"\n"
"`defaultSessionConfiguration`: Creates a default configuration object\n"
"that uses the disk-persisted global cache, credential and cookie storage\n"
"objects.\n"
"\n"
"`ephemeralSessionConfiguration`: Similar to the default configuration,\n"
"except that all session-related data is stored in memory. Think of this\n"
"as a \"private\" session.\n"
"\n"
"`backgroundSessionConfiguration`: Lets the session perform upload or\n"
"download tasks in the background. Transfers continue even when the app\n"
"itself is suspended or terminated.\n"
"\n"
"NSURLSessionConfiguration also lets you configure session properties\n"
"such as timeout values, caching policies and additional HTTP headers.\n"
"Refer to the documentation for a full list of configuration options.\n"
"\n"
"Example Implementation\n"
"----------------------\n"
msgstr ""

#: vulnerabilities.py:2751 vulnerabilities.py:2752
msgid "PhoneGap JavaScript Injection"
msgstr ""

#: vulnerabilities.py:2753
msgid "Does the application have PhoneGap javascript injection vulnerability?"
msgstr ""

#: vulnerabilities.py:2754
msgid ""
"The application does not seem to be affected by PhoneGap javascript "
"injection."
msgstr ""

#: vulnerabilities.py:2756
msgid ""
"\n"
"PhoneGap uses web technology to help bridge the gap between mobile and\n"
"web.\n"
"\n"
"Applications built for PhoneGap are hybrid apps, and are neither fully\n"
"native or truly web-based, living somewhere in between. Because mobile\n"
"OSes don't natively support HTML5 and JavaScript, PhoneGap apps use\n"
"WebView, a web container that allows mobile devices to execute\n"
"JavaScript and HTML5. WebView (called various terms for differing\n"
"platforms) helps bridge the gap between web and mobile, and various\n"
"plugins help make an application more robust and native-feeling.\n"
"\n"
"Communicating with each OS, PhoneGap uses different APIs (built by\n"
"PhoneGap) and plugins (both native and custom), which act as the bridge\n"
"between each platform's native language and the PhoneGap script. Out of\n"
"the box, PhoneGap comes with APIs for Camera, Contacts, Compass, Media,\n"
"FileSystem and more. Plugins extend those functionalities not accessible\n"
"with the available APIs.\n"
msgstr ""

#: vulnerabilities.py:2775
msgid ""
"\n"
"Application using older version of Phonegap has Javascript Injection\n"
"Vulnerability\n"
msgstr ""

#: vulnerabilities.py:2779 vulnerabilities.py:2787 vulnerabilities.py:2827
#: vulnerabilities.py:2835 vulnerabilities.py:2875 vulnerabilities.py:2883
#: vulnerabilities.py:3034 vulnerabilities.py:3042
msgid ""
"\n"
"With Cordova 3.5.0 or prior, attackers may:\n"
"\n"
"- Open and send data to arbitrary applications.\n"
"- Bypass the HTTP whitelist and connect to arbitrary servers.\n"
"- Change the start page via a crafted intent URL.\n"
"\n"
msgstr ""

#: vulnerabilities.py:2795 vulnerabilities.py:2891 vulnerabilities.py:2940
#: vulnerabilities.py:3050
msgid ""
"\n"
"Upgrade Phonegap or Apache Cordova to the latest version.\n"
msgstr ""

#: vulnerabilities.py:2808 vulnerabilities.py:2809
msgid "Remote URL Redirection Vulnerability"
msgstr ""

#: vulnerabilities.py:2810
msgid ""
"Does the application use an older version of PhoneGap that allows remote "
"attackers to perform URL redirection?"
msgstr ""

#: vulnerabilities.py:2811
msgid ""
"The application is not vulnerable to URL redirection vulnerability, or is "
"not using PhoneGap."
msgstr ""

#: vulnerabilities.py:2813
msgid ""
"\n"
"Android applications built with the Cordova framework can be launched\n"
"through a special intent URL. A specially-crafted URL could cause the\n"
"Cordova-based application to start up with a different start page than\n"
"the developer intended, including other HTML content stored on the\n"
"Android device. This has been the case in all released versions of\n"
"Cordova up to 3.5.0, and has been fixed in the latest release (3.5.1).\n"
"We recommend affected projects to update their applications to the\n"
"latest release.\n"
msgstr ""

#: vulnerabilities.py:2823
msgid ""
"\n"
"Android application which uses older version of PhoneGap is vulnerable\n"
"to URL redirection to arbitary website as defined by CVE-3500\n"
msgstr ""

#: vulnerabilities.py:2843
msgid ""
"\n"
"Upgrade your Phonegap or Apache Cordova application to the latest\n"
"Version\n"
msgstr ""

#: vulnerabilities.py:2857 vulnerabilities.py:2858
msgid "PhoneGap Error URL Redirection Vulnerability"
msgstr ""

#: vulnerabilities.py:2859
msgid ""
"Can the application allow remote attackers to perform Error URL redirection?"
msgstr ""

#: vulnerabilities.py:2860
msgid ""
"The application is not vulnerable to error URL redirection vulnerability, or "
"is not using PhoneGap."
msgstr ""

#: vulnerabilities.py:2862
msgid ""
"\n"
"Cordova-based applications make use of a WebView in order to interact\n"
"with the user. This vulnerability uses the errorurl parameter which can\n"
"be passed via Intent extras (in CordovaActivity) by a malicious caller,\n"
"but it is not automatically loaded into a WebView on application load.\n"
"The errorurl will only be rendered by the WebView when a network request\n"
"fails. This presents a vulnerability which can be exploited whereby a\n"
"malicious caller could launch the Activity.\n"
msgstr ""

#: vulnerabilities.py:2871
msgid ""
"\n"
"Android application which uses older version of PhoneGap is vulnerable\n"
"to Error URL redirection to arbitary website as defined by CVE-3500\n"
msgstr ""

#: vulnerabilities.py:2904 vulnerabilities.py:2905
msgid "PhoneGap HTTPS Bypass Vulnerability"
msgstr ""

#: vulnerabilities.py:2906
msgid ""
"Is the application using deprecated version of PhonGap which is susceptible "
"to HTTPS Bypass?"
msgstr ""

#: vulnerabilities.py:2907
msgid ""
"The application does not use a vulnerable version of PhoneGap, or is not "
"using PhoneGap."
msgstr ""

#: vulnerabilities.py:2909
msgid ""
"\n"
"Android applications built with the Cordova framework use a WebView\n"
"component to display content. Cordova applications can specify a\n"
"whitelist of URLs which the application will be allowed to display, or\n"
"to communicate with via XMLHttpRequest. This whitelist, however, is not\n"
"used by the WebView component when it is directed via JavaScript to\n"
"communicate over non-http channels.\n"
"\n"
"Specifically, it can be possible to open a WebSocket connection from the\n"
"application JavaScript which will connect to any reachable server on the\n"
"Internet. If an attacker is able to execute arbitrary JavaScript within\n"
"the application, then that attacker can cause a connection to be opened\n"
"to any server, bypassing the HTTP whitelist.\n"
"\n"
"This is a limitation of the hybrid app architecture on Android in\n"
"general, and not specific to Apache Cordova.\n"
msgstr ""

#: vulnerabilities.py:2926
msgid ""
"\n"
"Deprecated Android PhoneGap application is affected with CVE-3501 via\n"
"which attackers can downgrade HTTPS connection to HTTP\n"
msgstr ""

#: vulnerabilities.py:2930 vulnerabilities.py:2935
msgid ""
"\n"
"The attacker can open a WebSocket connection from the application\n"
"JavaScript which will connect to any remote server bypassing the HTTP\n"
"whitelist.\n"
msgstr ""

#: vulnerabilities.py:2953 vulnerabilities.py:2954
msgid "PhoneGap HTTPS Whitelist Bypass"
msgstr ""

#: vulnerabilities.py:2955
msgid "Does the PhoneGap application use vulnerable regex for whitelisting?"
msgstr ""

#: vulnerabilities.py:2956
msgid ""
"The PhoneGap application seems to be using proper regex check, or is not "
"using PhoneGap."
msgstr ""

#: vulnerabilities.py:2958
msgid ""
"\n"
"In order to ensure that a Cordova WebView only allows requests to URLs\n"
"in the configured whitelist, the framework overrides Android's\n"
"`shouldInterceptRequest()`\n"
"\n"
"The use of `shouldInterceptRequest()` to provide the whitelisting\n"
"mechanism is problematic in that it is used to intercept only certain\n"
"requests (such as those serviced over HTTP/S or through the file URI).\n"
"There may be protocols for which this function is not called by the\n"
"Android framework. As of Android 4.4 KitKat, the WebView is rendered by\n"
"Chromium and supports Web Sockets which one such protocol. An attacker\n"
"can therefore make use of a WebSocket connection to bypass the Cordova's\n"
"white-listing mechanism.\n"
msgstr ""

#: vulnerabilities.py:2972
msgid ""
"\n"
"In PhoneGap if regex is used to whitelist, this checks if HTTPS can be\n"
"bypassed from that regex\n"
msgstr ""

#: vulnerabilities.py:2976 vulnerabilities.py:2981
msgid ""
"\n"
"An attacker can bypass the Cordova's white-listing mechanism and\n"
"initiate connections to unauthorized remote servers. This may aid in\n"
"further attacks.\n"
msgstr ""

#: vulnerabilities.py:2986
msgid ""
"\n"
"Domain whitelisting is a security model that controls access to external\n"
"domains over which you application has no control. Cordova's default\n"
"security policy allows access to any site. Before moving your\n"
"application to production, you should formulate a whitelist and allow\n"
"access to specific network domains and subdomains.\n"
"\n"
"Cordova adheres to the W3C Widget Access specification, which relies on\n"
"the &lt;access&gt; element within the app's config.xml file to enable\n"
"network access to specific domains. For projects that rely on the CLI\n"
"workflow described in The Command-Line Interface, this file is located\n"
"in the project's top-level directory. Otherwise for platform-specific\n"
"development paths, locations are listed in the sections below:\n"
"\n"
"The following examples demonstrate whitelist syntax:\n"
"\n"
msgstr ""

#: vulnerabilities.py:3002
msgid ""
"\n"
"\n"
"This is the default value for newly created CLI projects which not\n"
"secured.\n"
"\n"
"Also Please Upgrade your Phonegap or Apache Cordova application to the\n"
"latest Version\n"
msgstr ""

#: vulnerabilities.py:3020 vulnerabilities.py:3021
msgid "Cordova Remote Start Page Manipulation Vulnerability"
msgstr ""

#: vulnerabilities.py:3022
msgid ""
"Is the application affected by CVE-3500 that allows remote attackers to "
"change the start page?"
msgstr ""

#: vulnerabilities.py:3023
msgid ""
"The application is not affected by CVE-3500, or Apache Cordova is not being "
"used."
msgstr ""

#: vulnerabilities.py:3025
msgid ""
"\n"
"Apache Cordova for Android version 3.5.0 and prior are vulnerable.\n"
"Attackers can exploit these issues to bypass security restrictions to\n"
"perform unauthorized actions. This may aid in further attacks.\n"
msgstr ""

#: vulnerabilities.py:3030
msgid ""
"\n"
"According to CVE-3500 Apache Cordova had a vulnerability to change the\n"
"start page\n"
msgstr ""

#: vulnerabilities.py:3063 vulnerabilities.py:3064 vulnerabilities.py:4780
#: vulnerabilities.py:4781
msgid "PhoneGap Debug Logging"
msgstr ""

#: vulnerabilities.py:3065
msgid "Are PhoneGap application debug logs enabled?"
msgstr ""

#: vulnerabilities.py:3066
msgid "PhoneGap debug logs are not enabled, or PhoneGap is not being used."
msgstr ""

#: vulnerabilities.py:3068
msgid ""
"\n"
"Once a PhoneGap app gets shipped with debug mode switched \"on\" then\n"
"anyone can attach a debugger and change the logical flow of the\n"
"application. Also, sensitive logs get leaked which can be used to\n"
"determine the URL endpoints of the application.\n"
msgstr ""

#: vulnerabilities.py:3074
msgid ""
"\n"
"While using PhoneGap to develop application, always stop debugging logs\n"
"via PhoneGap\n"
msgstr ""

#: vulnerabilities.py:3078 vulnerabilities.py:3083
msgid ""
"\n"
"An attacker can attach a debugger and change the logical flow of the\n"
"application. Additionally, sensitive logs can get leaked which can be\n"
"used to determine the URL endpoints of the application.\n"
msgstr ""

#: vulnerabilities.py:3088 vulnerabilities.py:4799
msgid ""
"\n"
"If using Cordova, please publish the plugin using\n"
"\n"
msgstr ""

#: vulnerabilities.py:3091
msgid ""
"\n"
"\n"
"If using PhoneGap, please turn of all console.logs() and other logging\n"
"codes before publishing\n"
msgstr ""

#: vulnerabilities.py:3106 vulnerabilities.py:3107
msgid "PhoneGap Whitelisted URLs"
msgstr ""

#: vulnerabilities.py:3108
msgid "Does the PhoneGap application properly whitelist URLs"
msgstr ""

#: vulnerabilities.py:3109
msgid "Application has proper whitelisted URLs, or does not use PhoneGap."
msgstr ""

#: vulnerabilities.py:3111
msgid ""
"\n"
"Domain whitelisting is a security model that controls access to external\n"
"domains over which your application has no control. Cordova provides a\n"
"configurable security policy to define which external sites may be\n"
"accessed. By default, new apps are configured to allow access to any\n"
"site. Before moving your application to production, you should formulate\n"
"a whitelist and allow access to specific network domains and subdomains.\n"
msgstr ""

#: vulnerabilities.py:3119
msgid ""
"\n"
"While using PhoneGap to develop application, always try to whitelist the\n"
"URL via which it connects\n"
msgstr ""

#: vulnerabilities.py:3123 vulnerabilities.py:3128
msgid ""
"\n"
"Without Domain Whitelisting, an attacker can load any domain in an\n"
"iframe and any script on that page within the iframe can directly access\n"
"Cordova JavaScript objects and the corresponding native Java objects.\n"
msgstr ""

#: vulnerabilities.py:3133
msgid ""
"\n"
"Cordova adheres to the W3C Widget Access specification, which relies on\n"
"the `<access>` element within the app's `config.xml` file to enable\n"
"network access to specific domains. For projects that rely on the CLI\n"
"workflow described in The Command-Line Interface, this file is located\n"
"in the project's top-level directory. Otherwise for platform-specific\n"
"development paths, locations are listed in the sections below:\n"
"\n"
"The following examples demonstrate whitelist syntax:\n"
"\n"
msgstr ""

#: vulnerabilities.py:3143
msgid ""
"\n"
"\n"
"This is the default value for newly created CLI projects which not\n"
"secured.\n"
msgstr ""

#: vulnerabilities.py:3158 vulnerabilities.py:3159
msgid "Connection to External Redis Server"
msgstr ""

#: vulnerabilities.py:3160
msgid "Does the application communicate with an external Redis server?"
msgstr ""

#: vulnerabilities.py:3161
msgid "The application does not communicate with an external Redis server."
msgstr ""

#: vulnerabilities.py:3163
msgid ""
"\n"
"Redis framework should be used strictly in server to server\n"
"communication. Using Redis in the client side compromises security\n"
"because the credentials can be read in plain text.\n"
msgstr ""

#: vulnerabilities.py:3168
msgid ""
"\n"
"Android applications which use Redis to communicate are vulnerable\n"
msgstr ""

#: vulnerabilities.py:3171 vulnerabilities.py:3175
msgid ""
"\n"
"The database and associated data including user credentials may get\n"
"compromised.\n"
msgstr ""

#: vulnerabilities.py:3179
msgid ""
"\n"
"Remove Redis client completely. If any SDK uses this component, then\n"
"please remove the SDK itself\n"
msgstr ""

#: vulnerabilities.py:3193 vulnerabilities.py:3194
msgid "Unprotected Exported Activities"
msgstr ""

#: vulnerabilities.py:3195
msgid "Are any activities exported insecurely?"
msgstr ""

#: vulnerabilities.py:3196
msgid "The application does not insecurely export any activities."
msgstr ""

#: vulnerabilities.py:3198
msgid ""
"\n"
"Activities provide user interfaces. Activities are started with Intents,\n"
"and they can return data to their invoking components upon completion.\n"
"All visible portions of applications are Activities.\n"
"\n"
"Exported Activities can be called by any other application installed in\n"
"the phone leading to XAS (Cross Application Scripting)\n"
msgstr ""

#: vulnerabilities.py:3206
msgid ""
"\n"
"The Android application exports Activity for use by other applications,\n"
"but does not properly restrict which applications can launch the\n"
"component or access the data it contains.\n"
msgstr ""

#: vulnerabilities.py:3211 vulnerabilities.py:3216 vulnerabilities.py:3270
#: vulnerabilities.py:3275 vulnerabilities.py:3323 vulnerabilities.py:3328
#: vulnerabilities.py:3373 vulnerabilities.py:3378 vulnerabilities.py:3423
#: vulnerabilities.py:3428 vulnerabilities.py:3480 vulnerabilities.py:3485
#: vulnerabilities.py:3531 vulnerabilities.py:3536 vulnerabilities.py:3579
#: vulnerabilities.py:3584
msgid ""
"\n"
"Attackers may use non-privileged services to intercept and track the\n"
"user's activity. Furthermore, it may be possible to insert data that may\n"
"maliciously modify the behaviour of the application.\n"
msgstr ""

#: vulnerabilities.py:3221
msgid ""
"\n"
"If you are using a Activity for sharing between only your own apps, it\n"
"is preferable to use the android:protectionLevel attribute set to\n"
"\"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the application when the apps accessing the\n"
"Activity are signed with the same key\n"
"\n"
"If the activity is called within itself, then don't export it or use\n"
"Intent-Filter for custom permissions\n"
msgstr ""

#: vulnerabilities.py:3242 vulnerabilities.py:3243
msgid "Unprotected Exported Receivers"
msgstr ""

#: vulnerabilities.py:3244
msgid "Does the application export Broadcast Receivers?"
msgstr ""

#: vulnerabilities.py:3245
msgid "The application does not export Broadcast Receivers."
msgstr ""

#: vulnerabilities.py:3247
msgid ""
"\n"
"Broadcast Receivers receive Intents sent to multiple applications.\n"
"Receivers are triggered by the receipt of an appropriate Intent and then\n"
"run in the background to handle the event. Receivers are typically\n"
"short-lived; they often relay messages to Activities or Services. There\n"
"are three types of broadcast Intents: normal, sticky, and ordered.\n"
"Normal broadcasts are sent to all registered Receivers at once, and then\n"
"they disappear. Ordered broadcasts are delivered to one Receiver at a\n"
"time; also, any Receiver in the delivery chain of an ordered broadcast\n"
"can stop its propagation. Broadcast Receivers have the ability to set\n"
"their priority level for receiving ordered broadcasts. Sticky broadcasts\n"
"remain accessible after they have been delivered and are re-broadcast to\n"
"future Receivers.\n"
"\n"
"Exported Broadcast Receiver can be called by any other malicious\n"
"application installed in the phone to invoke the Broadcast Receiver\n"
"leading to XAS (Cross Application Scripting)\n"
msgstr ""

#: vulnerabilities.py:3265
msgid ""
"\n"
"The Android application exports Receiver for use by other applications,\n"
"but does not properly restrict which applications can launch the\n"
"component or access the data it contains.\n"
msgstr ""

#: vulnerabilities.py:3280
msgid ""
"\n"
"If you are using a Broadcast Receiver for sharing data between only your\n"
"own apps, it is preferable to use the `android:protectionLevel` attribute\n"
"set to \"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the Broadcast Receiver when the apps accessing the\n"
"data are signed with the same key\n"
"\n"
"If the Broadcast Receiver is called within itself, then don't export it\n"
"or use Intent-Filter for custom permissions\n"
msgstr ""

#: vulnerabilities.py:3301 vulnerabilities.py:3302
msgid "Unprotected Exported Service"
msgstr ""

#: vulnerabilities.py:3303
msgid "Are any services insecurely exported?"
msgstr ""

#: vulnerabilities.py:3304
msgid "The application does not export any services insecurely."
msgstr ""

#: vulnerabilities.py:3306
msgid ""
"\n"
"Services run in the background and do not interact with the user.\n"
"Downloading a file or decompressing an archive are examples of\n"
"operations that may take place in a Service. Other components can bind\n"
"to a Service, which lets the binder invoke methods that are declared in\n"
"the target Service's interface. Intents are used to start and bind to\n"
"Services\n"
"\n"
"Exported Services can be called by any other application installed in\n"
"the phone to bind into the service leading to XAS (Cross Application\n"
"Scripting)\n"
msgstr ""

#: vulnerabilities.py:3318
msgid ""
"\n"
"The Android application exports Service for use by other applications,\n"
"but does not properly restrict which applications can launch the\n"
"component or access the data it contains.\n"
msgstr ""

#: vulnerabilities.py:3333
msgid ""
"\n"
"If you are using a Service for sharing data between only your own apps,\n"
"it is preferable to use the `android:protectionLevel` attribute set to\n"
"\"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the Service when the apps accessing the data are\n"
"signed with the same key\n"
"\n"
"If the Service is called within itself, then don't export it or use\n"
"Intent-Filter for custom permissions\n"
msgstr ""

#: vulnerabilities.py:3354 vulnerabilities.py:3355
msgid "Unprotected Exported Provider"
msgstr ""

#: vulnerabilities.py:3356
msgid "Are any providers insecurely exported?"
msgstr ""

#: vulnerabilities.py:3357
msgid "The application does not export any providers insecurely."
msgstr ""

#: vulnerabilities.py:3359
msgid ""
"\n"
"Content Providers are databases addressable by their application-defined\n"
"URIs. They are used for both persistent internal data storage and as a\n"
"mechanism for sharing information between applications.\n"
"\n"
"Exported Content Provider can be called by any other malicious\n"
"application installed in the phone to get the data via Content Provider\n"
"leading to XAS (Cross Application Scripting)\n"
msgstr ""

#: vulnerabilities.py:3368
msgid ""
"\n"
"The Android application exports a Content Provider for use by other\n"
"applications, but does not properly restrict which applications can\n"
"launch the component or access the data it contains.\n"
msgstr ""

#: vulnerabilities.py:3383
msgid ""
"\n"
"If you are using a Content Provider for sharing data between only your\n"
"own apps, it is preferable to use the `android:protectionLevel` attribute\n"
"set to \"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the content provider data when the apps accessing\n"
"the data are signed with the same key\n"
"\n"
"If the Content Provider is called within itself, then don't export it or\n"
"use Intent-Filter for custom permissions\n"
msgstr ""

#: vulnerabilities.py:3404 vulnerabilities.py:3405
msgid "Non-signature Protected Exported Activities"
msgstr ""

#: vulnerabilities.py:3406
msgid "Are any activities exported without a ProtectionLevel?"
msgstr ""

#: vulnerabilities.py:3407
msgid "The application does not export any activity without a ProtectionLevel."
msgstr ""

#: vulnerabilities.py:3409
msgid ""
"\n"
"Activities provide user interfaces. Activities are started with Intents,\n"
"and they can return data to their invoking components upon completion.\n"
"All visible portions of applications are Activities.\n"
"\n"
"Exported Unprotected Activities can be called by any other application\n"
"installed in the phone leading to XAS (Cross Application Scripting)\n"
msgstr ""

#: vulnerabilities.py:3417
msgid ""
"\n"
"The Android application exports Activity for use by other applications,\n"
"but does not properly restrict which applications can launch the\n"
"component or access the data it contains via custom signature defined by\n"
"`android:protectionLevel`.\n"
msgstr ""

#: vulnerabilities.py:3433
msgid ""
"\n"
"If you are using a Activity for sharing between only your own apps, it\n"
"is preferable to use the `android:protectionLevel` attribute set to\n"
"\"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the application when the apps accessing the\n"
"Activity are signed with the same key\n"
msgstr ""

#: vulnerabilities.py:3451 vulnerabilities.py:3452
msgid "Non-signature Protected Exported Receivers"
msgstr ""

#: vulnerabilities.py:3453
msgid "Are any Broadcast Receivers exported without a ProtectionLevel?"
msgstr ""

#: vulnerabilities.py:3454
msgid ""
"The application does not export any Broadcast Receivers without a "
"ProtectionLevel."
msgstr ""

#: vulnerabilities.py:3456
msgid ""
"\n"
"Broadcast Receivers receive Intents sent to multiple applications.\n"
"Receivers are triggered by the receipt of an appropriate Intent and then\n"
"run in the background to handle the event. Receivers are typically\n"
"short-lived; they often relay messages to Activities or Services. There\n"
"are three types of broadcast Intents: normal, sticky, and ordered.\n"
"Normal broadcasts are sent to all registered Receivers at once, and then\n"
"they disappear. Ordered broadcasts are delivered to one Receiver at a\n"
"time; also, any Receiver in the delivery chain of an ordered broadcast\n"
"can stop its propagation. Broadcast Receivers have the ability to set\n"
"their priority level for receiving ordered broadcasts. Sticky broadcasts\n"
"remain accessible after they have been delivered and are re-broadcast to\n"
"future Receivers.\n"
"\n"
"Exported Unprotected Broadcast Receiver can be called by any other\n"
"malicious application installed in the phone to invoke the Broadcast\n"
"Receiver leading to XAS (Cross Application Scripting)\n"
msgstr ""

#: vulnerabilities.py:3474
msgid ""
"\n"
"The Android application exports Broadcast Receiver for use by other\n"
"applications, but does not properly restrict which applications can\n"
"launch the component or access the data it containscustom signature\n"
"defined by `android:protectionLevel`.\n"
msgstr ""

#: vulnerabilities.py:3490
msgid ""
"\n"
"If you are using a Broadcast Receiver for sharing data between only your\n"
"own apps, it is preferable to use the `android:protectionLevel` attribute\n"
"set to \"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the Broadcast Receiver when the apps accessing the\n"
"data are signed with the same key\n"
msgstr ""

#: vulnerabilities.py:3508 vulnerabilities.py:3509
msgid "Non-signature Protected Exported Services"
msgstr ""

#: vulnerabilities.py:3510
msgid "Are any services exported without a ProtectionLevel?"
msgstr ""

#: vulnerabilities.py:3511
msgid "The application does not export any service without a ProtectionLevel."
msgstr ""

#: vulnerabilities.py:3513
msgid ""
"\n"
"Services run in the background and do not interact with the user.\n"
"Downloading a file or decompressing an archive are examples of\n"
"operations that may take place in a Service. Other components can bind\n"
"to a Service, which lets the binder invoke methods that are declared in\n"
"the target Service's interface. Intents are used to start and bind to\n"
"Services\n"
"\n"
"Exported Unprotected Services can be called by any other application\n"
"installed in the phone to bind into the service leading to XAS (Cross\n"
"Application Scripting)\n"
msgstr ""

#: vulnerabilities.py:3525
msgid ""
"\n"
"The Android application exports Service for use by other applications,\n"
"but does not properly restrict which applications can launch the\n"
"component or access the data it containscustom signature defined by\n"
"`android:protectionLevel`.\n"
msgstr ""

#: vulnerabilities.py:3541
msgid ""
"\n"
"If you are using a Service for sharing data between only your own apps,\n"
"it is preferable to use the `android:protectionLevel` attribute set to\n"
"\"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the Service when the apps accessing the data are\n"
"signed with the same key\n"
msgstr ""

#: vulnerabilities.py:3559 vulnerabilities.py:3560
msgid "Non-signature Protected Exported Providers"
msgstr ""

#: vulnerabilities.py:3561
msgid "Are any providers exported without a ProtectionLevel?"
msgstr ""

#: vulnerabilities.py:3562
msgid "The application does not export any provider without a ProtectionLevel."
msgstr ""

#: vulnerabilities.py:3564
msgid ""
"\n"
"Content Providers are databases addressable by their application-defined\n"
"URIs. They are used for both persistent internal data storage and as a\n"
"mechanism for sharing information between applications.\n"
"\n"
"Exported and Unprotected Content Provider can be called by any other\n"
"malicious application installed in the phone to get the data via Content\n"
"Provider leading to XAS (Cross Application Scripting)\n"
msgstr ""

#: vulnerabilities.py:3573
msgid ""
"\n"
"The Android application exports Content Provider for use by other\n"
"applications, but does not properly restrict which applications can\n"
"launch the component or access the data it containscustom signature\n"
"defined by `android:protectionLevel`.\n"
msgstr ""

#: vulnerabilities.py:3589
msgid ""
"\n"
"If you are using a Content Provider for sharing data between only your\n"
"own apps, it is preferable to use the `android:protectionLevel` attribute\n"
"set to \"signature\" protection. Signature permissions do not require user\n"
"confirmation, so they provide a better user experience and more\n"
"controlled access to the content provider data when the apps accessing\n"
"the data are signed with the same key\n"
msgstr ""

#: vulnerabilities.py:3607 vulnerabilities.py:3608
msgid "Content Provider File Traversal Vulnerability"
msgstr ""

#: vulnerabilities.py:3609
msgid ""
"Is the application vulnerable to content provider directory traversal "
"attacks?"
msgstr ""

#: vulnerabilities.py:3610
msgid ""
"Application does not seem to be vulnerable to content provider directory "
"traversal attacks."
msgstr ""

#: vulnerabilities.py:3612
msgid ""
"\n"
"Content Providers are databases addressable by their application-defined\n"
"URIs. They are used for both persistent internal data storage and as a\n"
"mechanism for sharing information between applications.\n"
"\n"
"By using the `ContentProvider.openFile()` method, you can provide a\n"
"facility for another application to access your application data (file).\n"
"Depending on the implementation of ContentProvider, use of the method\n"
"can lead to a directory traversal vulnerability. Hence, when exchanging\n"
"a file through a content provider, the path should be canonicalized\n"
"before it is used.\n"
msgstr ""

#: vulnerabilities.py:3624
msgid ""
"\n"
"Depending on the implementation of `ContentProvider`, use of the method\n"
"can lead to a directory traversal vulnerability.\n"
msgstr ""

#: vulnerabilities.py:3628 vulnerabilities.py:3633
msgid ""
"\n"
"Directory Traversal exploits allow attackers to escape the context of\n"
"the sandboxed application and read/write local files compromising the\n"
"application/device.\n"
msgstr ""

#: vulnerabilities.py:3638
msgid ""
"\n"
"By using the canonicalized path, directory traversal will be mitigated\n"
"even when a doubly-encoded path is supplied.\n"
"\n"
msgstr ""

#: vulnerabilities.py:3643
msgid ""
"\n"
"This non-compliant code example tries to retrieve the last segment from\n"
"the path paramUri, which is supposed to denote a file name, by calling\n"
"`android.net.Uri.getLastPathSegment()`. The file is accessed in the\n"
"pre-configured parent directory IMAGE\\_DIRECTORY.\n"
"\n"
msgstr ""

#: vulnerabilities.py:3649
msgid ""
"\n"
"\n"
"This non-compliant code example attempts to fix the first non-compliant\n"
"code example by calling `Uri.getLastPathSegment()` twice. The first call\n"
"is intended for URL decoding and the second call is to obtain the string\n"
"the developer wanted.\n"
"\n"
msgstr ""

#: vulnerabilities.py:3657
msgid ""
"\n"
"- JVN\\#78601526 GREE for Android vulnerable to directory traversal:\n"
"  <https://www.securecoding.cert.org/confluence/display/android/DRD08-J."
"+Always+canonicalize+a+URL+received+by+a+content+provider>\n"
"\n"
msgstr ""

#: vulnerabilities.py:3670 vulnerabilities.py:3671
msgid "Insecure Cryptographic Keys"
msgstr ""

#: vulnerabilities.py:3672
msgid ""
"Does the application use insecure encryption algorithms or configurations?"
msgstr ""

#: vulnerabilities.py:3673
msgid ""
"The application does not use insecure encryption algorithms or "
"configurations."
msgstr ""

#: vulnerabilities.py:3675
msgid ""
"\n"
"Using the CCCryptor, one can use common sounding functions such as\n"
"`CCCryptorCreate`, `CCCryptorUpdate`, `CCCryptorFinal` (or simply "
"`CCCrypt()`\n"
"one-shot function) to perform symmetric encryption using different\n"
"algorithms like AES, 3DES and hardcore security ciphers like RC4, DES,\n"
"etc.\n"
"\n"
"Apple supports ECB and CBC mode for their ciphers, and fortunately a\n"
"developer really needs to explicitly prove stupidity by using ECB since\n"
"APIs default to CBC, the Cipher Block Chaining mode. What could possibly\n"
"go wrong? Right, there is some minor thing that is called the \"IV\".\n"
"Apple supposedly translated the acronym IV to \"Ignorance Vector\" when\n"
"writing their Common Crypto API man-pages, but we should read\n"
"\"Initialization Vector\" - used to initialize the very first block of\n"
"cipher text.\n"
msgstr ""

#: vulnerabilities.py:3691
msgid ""
"\n"
"Application seems to be using the correct cryptographic encryption\n"
"method, or is not using it.\n"
msgstr ""

#: vulnerabilities.py:3695 vulnerabilities.py:3700
msgid ""
"\n"
"Using an insecure initialization vector allows the attacker to perform\n"
"frequency analysis on the ciphertext. An all-zero IV would mean that the\n"
"initial portion of ciphertext is effectively just substition.\n"
msgstr ""

#: vulnerabilities.py:3705
msgid ""
"\n"
"The mystical initialization vector (IV) is confusing. In CBC-mode, each\n"
"16-byte encryption influences the next 16-byte encryption. It's also the\n"
"default. The problem is about block 0. It is a random block -1 which is\n"
"the IV.\n"
"\n"
"This is listed as optional in `CCCrypt()` which is confusing because it\n"
"isn't really optional in CBC mode. If it is not provided, then it'll\n"
"automatically generate an all-0 IV. That throws away significant\n"
"protection on the first block. IV is just 16 random bytes.\n"
"\n"
"The method returns the encrypted data (nil for error), and returns the\n"
"IV, salt and error by reference.\n"
"\n"
msgstr ""

#: vulnerabilities.py:3730 vulnerabilities.py:3731
msgid "iOS SecKeyEncrypt implementation"
msgstr ""

#: vulnerabilities.py:3732
msgid "Does the application use proper SecKeyEncrypt implementation?"
msgstr ""

#: vulnerabilities.py:3733
msgid ""
"The application uses proper SecKeyEncrypt, or SecKeyEncrypt is not "
"implemented."
msgstr ""

#: vulnerabilities.py:3735
msgid ""
"\n"
"Most of the time iOS handles all the encryption. It automatically\n"
"encrypts and decrypts HTTPS for network traffic and manages encrypted\n"
"files using file protection.\n"
"\n"
"But in case of custom implementation `SecKeyEncrypt` and `SecKeyDecrypt` is\n"
"called\n"
msgstr ""

#: vulnerabilities.py:3743
msgid ""
"\n"
"`SecKeyEncrypt` determines how to encrypt data from a PUBLIC KEY in iOS\n"
msgstr ""

#: vulnerabilities.py:3759 vulnerabilities.py:3760
msgid "Insecure Peer Connections"
msgstr ""

#: vulnerabilities.py:3761
msgid ""
"Does the application securely communicate with other devices over MultiPeer "
"Framework?"
msgstr ""

#: vulnerabilities.py:3762
msgid ""
"The application uses MultiPeer Framework properly, or MultiPeer Framework is "
"not being used."
msgstr ""

#: vulnerabilities.py:3764
msgid ""
"\n"
"Multi-peer Connectivity Framework makes the task of exchanging data or\n"
"other resources with the nearby devices easy. The framework provides a\n"
"provision where the connection with the peers can be created in an\n"
"encrypted manner. Applications should enable the encryption feature\n"
"while exchanging data with the peers which ensures the confidentiality\n"
"of data.\n"
msgstr ""

#: vulnerabilities.py:3772
msgid ""
"\n"
"MultiPeer Connectivity Framework is used for establishing connection\n"
"with the devices in close proximity\n"
msgstr ""

#: vulnerabilities.py:3776 vulnerabilities.py:3780
msgid ""
"\n"
"Failing to use encrypted channels may undermine the confidentiality of\n"
"the transmitted data.\n"
msgstr ""

#: vulnerabilities.py:3784
msgid ""
"\n"
"While establishing a connection with the peer always initialize the\n"
"session with encryption preference set as `MCEncryptionRequired` to\n"
"ensure that complete data is shared on an encrypted channel.\n"
msgstr ""

#: vulnerabilities.py:3799 vulnerabilities.py:3800
msgid "Unsecured Keychain Data"
msgstr ""

#: vulnerabilities.py:3801
msgid "Does the application insecurely store data in Keychain?"
msgstr ""

#: vulnerabilities.py:3802
msgid "The application does not store sensitive data in Keychain."
msgstr ""

#: vulnerabilities.py:3804
msgid ""
"\n"
"iOS provides the Keychain for secure data storage. However, in several\n"
"scenarios, the Keychain can be compromised and subsequently decrypted.\n"
"\n"
"In all versions of iOS up to and including iOS 7, Keychain can be\n"
"partially compromised if attacker has access to the encrypted iTunes\n"
"backup. Due to the way iOS re-encrypts Keychain entries when creating\n"
"iTunes backups, it is possible to partially decrypt Keychain when iTunes\n"
"backup is available and password for backup encryption is known (note\n"
"that iTunes backups that are not encrypted do not allow decryption of\n"
"Keychain items).\n"
"\n"
"Keychain access controls are rendered ineffective if a jailbreak has\n"
"been applied to the device. In this case any application running on the\n"
"device can potentially read every other application's Keychain items.\n"
"\n"
"Lastly, for older devices, such as the iPhone 4, for which so-called\n"
"\"bootrom exploits\" exist, the Keychain can be compromised by an attacker\n"
"with physical access to the device.\n"
msgstr ""

#: vulnerabilities.py:3824
msgid ""
"\n"
"Insecured data kept in iOS Keychain\n"
msgstr ""

#: vulnerabilities.py:3827 vulnerabilities.py:3832
msgid ""
"\n"
"Failing to take proper precautions may result in loss of login\n"
"credentials, passwords and other highly sensitive data stored in the\n"
"keychain.\n"
msgstr ""

#: vulnerabilities.py:3837
msgid ""
"\n"
"Store the sensitive data such as passwords in an encrypted form on the\n"
"device keychain so that even if the device is compromised no one can\n"
"infer correct passwords.\n"
"\n"
"When storing data in the Keychain, use the most restrictive protection\n"
"class (as defined by `kSecAttrAccessible` attribute) that still allows\n"
"your application to function properly. For example, if your application\n"
"is not designed to be running in the background, use\n"
"`kSecAttrAccessibleWhenUnlocked` or\n"
"`kSecAttrAccessibleWhenUnlockedThisDeviceOnly`\n"
"\n"
"To prevent Keychain item exposure via iTunes backup, use one of\n"
"`...ThisDeviceOnly` protection classes if practical.\n"
"\n"
"Finally, for highly sensitive data, consider augmenting protections\n"
"offered by the Keychain with application-level encryption. For example,\n"
"rely upon the user to enter a passphrase to authenticate within the\n"
"application and use that passphrase to encrypt data before storing it\n"
"into the Keychain.\n"
"\n"
"Example Implementation:\n"
"\n"
msgstr ""

#: vulnerabilities.py:3861
msgid ""
"\n"
"Not in compliance with OWASP Mobile Top 10 for M8 - Side Channel Data\n"
"Leakage Example keychain implementation where the pincode is stored\n"
"insecurely:\n"
"\n"
msgstr ""

#: vulnerabilities.py:3867
msgid ""
"\n"
"- [Keychain Services Programming\n"
"  Guide](https://developer.apple.com/library/ios/documentation/security/"
"Conceptual/keychainServConcepts/01introduction/introduction.html#//apple_ref/"
"doc/uid/TP30000897)\n"
"- [M2 - Insecure Data\n"
"  Storage](https://www.owasp.org/index.php/Mobile_Top_10_2014-M2)\n"
"- [M5 - Poor Authorization and\n"
"  Authentication](https://www.owasp.org/index.php/Mobile_Top_10_2014-M5)\n"
"\n"
msgstr ""

#: vulnerabilities.py:3884 vulnerabilities.py:3885
msgid "Exposed Pasteboard Data"
msgstr ""

#: vulnerabilities.py:3886
msgid ""
"Does the application allow copy/paste functionalities in sensitive fields?"
msgstr ""

#: vulnerabilities.py:3887
msgid "The application has proper protection from general pasteboard."
msgstr ""

#: vulnerabilities.py:3889
msgid ""
"\n"
"Both iOS and Android support copy/paste. Sensitive data may be stored,\n"
"recoverable, or could be modified from the clipboard in clear text,\n"
"regardless of whether the source of the data was initially encrypted. If\n"
"it is in plaintext at the moment the user copies it, it will be in\n"
"plaintext when other applications access the clipboard.\n"
msgstr ""

#: vulnerabilities.py:3896
msgid ""
"\n"
"Exposing sensitive data like passwords in pasteboard/clipboard which can\n"
"be used by other applications\n"
msgstr ""

#: vulnerabilities.py:3900 vulnerabilities.py:3904
msgid ""
"\n"
"Failing to take proper precautions may result in loss of login\n"
"credentials, passwords and other sensitive data stored in the clipboard.\n"
msgstr ""

#: vulnerabilities.py:3908
msgid ""
"\n"
"Use application specific pasteboard. Also mark fields like passwords as\n"
"secure so that their data can never be copied\n"
"\n"
"Pasteboards may be public or private. Public pasteboards are called\n"
"system pasteboards; private pasteboards are created by apps, and hence\n"
"are called app pasteboards. Pasteboards must have unique names.\n"
"UIPasteboard defines two system pasteboards, each with its own name and\n"
"purpose:\n"
"\n"
"- `UIPasteboardNameGeneral` is for cut, copy, and paste operations\n"
"  involving a wide range of data types. You can obtain a singleton\n"
"  object representing the General pasteboard by invoking the\n"
"  generalPasteboard class method.\n"
"- `UIPasteboardNameFind` is for search operations. The string currently\n"
"  typed by the user in the search bar (`UISearchBar`) is written to this\n"
"  pasteboard, and thus can be shared between apps. You can obtain an\n"
"  object representing the Find pasteboard by calling the\n"
"  pasteboardWithName:create: class method, passing in\n"
"  UIPasteboardNameFind for the name.\n"
"\n"
"Typically you use one of the system-defined pasteboards, but if\n"
"necessary you can create your own app pasteboard using\n"
"pasteboardWithName:create: If you invoke pasteboardWithUniqueName,\n"
"UIPasteboard gives you a uniquely-named app pasteboard. You can discover\n"
"the name of a pasteboard through its name property\n"
"\n"
"Clear the Pasteboard once the application enters background. You can do\n"
"this by adding the following line in the method\n"
"\n"
msgstr ""

#: vulnerabilities.py:3939
msgid ""
"\n"
"Not in compliance with OWASP Mobile Top 10 for M8 - Side Channel Data\n"
"Leakage A general Pasteboard implementation looks like the following\n"
"\n"
msgstr ""

#: vulnerabilities.py:3944
msgid ""
"\n"
"- [JVN\\#76662040](https://jvn.jp/en/jp/JVN76662040/) Clipboard\n"
"  contents alteration vulnerability in Grani\n"
"- [JVN\\#64764004](http://jvn.jp/en/jp/JVN64764004/index.html) Clipboard\n"
"  contents alteration vulnerability in Sleipnir\n"
msgstr ""

#: vulnerabilities.py:3958 vulnerabilities.py:3959
msgid "Buffer Overflows and Underflows"
msgstr ""

#: vulnerabilities.py:3960
msgid "Does the application have buffer overflow or underflow vulnerabilities?"
msgstr ""

#: vulnerabilities.py:3961
msgid ""
"The application does not seem have buffer overflow or underflow "
"vulnerabilities."
msgstr ""

#: vulnerabilities.py:3963
msgid ""
"\n"
"iOS has several mechanisms which prevent the application from being\n"
"compromised at runtime. In order to understand the security issues that\n"
"affect iOS applications, it is important to understand and to known the\n"
"security features of the platform. The main security features of iOS\n"
"(<http://www.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf>) are:\n"
"\n"
"- Code signing: ensures that all applications come from a approved source "
"(using\n"
"  Apple-issued certificates)\n"
"- Generic exploit mitigations\n"
"    - Address Space Layout Randomization (ASLR): Usually compiled using `-"
"fPIE -pie`\n"
"    - Non Executable Memory (ARM's Execute Never feature)\n"
"    - Stack Smashing Protections (SSP): Usually compiled with `-fstack-"
"protector-all` flag\n"
"- Sandboxing\n"
"    - run applications as non-privileged user\n"
"    - 3rd-party apps are restricted in accessing files stored by other\n"
"      apps\n"
"- Memory Management\n"
"    - Automatic Reference Counting (ARC) protects applications\n"
"      from memory coruption issues by letting the compiler do the\n"
"      memory management stuff\n"
"\n"
msgstr ""

#: vulnerabilities.py:3986
msgid ""
"\n"
"Buffer overflows, both on the stack and on the heap, are a major source\n"
"of security vulnerabilities in C, Objective-C, and C++ code.\n"
msgstr ""

#: vulnerabilities.py:3992
msgid ""
"\n"
"Usually the ipa file will be decrypted at runtime by the kernel's mach\n"
"loader. If the binary is encrypted or not is easily found using otool\n"
"\n"
"An example where the binary is encrypted:\n"
"\n"
msgstr ""

#: vulnerabilities.py:4000
msgid ""
"\n"
"- [Avoiding Buffer Overflows and Underflows by\n"
"  Apple](https://developer.apple.com/library/ios/documentation/Security/"
"Conceptual/SecureCodingGuide/Articles/BufferOverflows.html)\n"
"- [Hacking and Securing iOS\n"
"  Applications](http://books.google.de/books?"
"id=huy8AwAAQBAJ&printsec=frontcover#v=onepage&q&f=false)\n"
"\n"
msgstr ""

#: vulnerabilities.py:4014 vulnerabilities.py:4015
msgid "Jailbreak Detection"
msgstr ""

#: vulnerabilities.py:4016
msgid "Does the app implement any form of jailbreak detection?"
msgstr ""

#: vulnerabilities.py:4017
msgid ""
"The app seems to implement routines that check if device has been jailbroken."
msgstr ""

#: vulnerabilities.py:4019
msgid ""
"\n"
"Jailbreaking is the removing of software restrictions imposed by Apple.\n"
"Jailbreaking permits root access to the iOS file system and manager,\n"
"allowing the download of additional applications and extensions that are\n"
"unavailable through the official Apple App Store. Attackers often target\n"
"jailbroken iPhones on which malware can be installed more easily.\n"
msgstr ""

#: vulnerabilities.py:4026
msgid ""
"\n"
"Jailbroken devices may make it easier for attackers to break into the\n"
"application. Employing jailbreak detection and limiting functionality of\n"
"application on jailbroken devices is recommended.\n"
msgstr ""

#: vulnerabilities.py:4031 vulnerabilities.py:4041
msgid ""
"\n"
"Attackers can run tools like Cycript, GDB, Snoop-it etc. to perform\n"
"runtime analysis and steal sensitive data from within applications. To\n"
"add an extra layer of security for your application, you should not\n"
"allow your application to be run on a jailbroken device. Note that there\n"
"are millions of jailbroken devices, so preventing your app from running\n"
"on a jailbroken device could lead to a limited userbase and/or bad App\n"
"Store reviews. An alternative option is to block some features in your\n"
"application rather than disabling the functionality entirely.\n"
msgstr ""

#: vulnerabilities.py:4051
msgid ""
"\n"
"Consider using jailbreak detection SDKs or libraries. Note that by\n"
"nature, jailbroken devices may prevent these methods from being 100%\n"
"accurate.\n"
msgstr ""

#: vulnerabilities.py:4065 vulnerabilities.py:4066
msgid "UIWebView Exploits"
msgstr ""

#: vulnerabilities.py:4067
msgid "Are there instances of UIWebView used in the app?"
msgstr ""

#: vulnerabilities.py:4068
msgid "UIWebView is not used in the app."
msgstr ""

#: vulnerabilities.py:4070
msgid ""
"\n"
"iOS offers the UIWebView class to embed web content in the app. This is\n"
"often used when a web application needs to be quickly ported to multiple\n"
"mobile platforms without having to create a specific UI for each.\n"
msgstr ""

#: vulnerabilities.py:4075
msgid ""
"\n"
"UIWebView can be susceptible to client side Javascript injection. It can\n"
"also retain sensitive content in the memory as cache\n"
msgstr ""

#: vulnerabilities.py:4079 vulnerabilities.py:4090
msgid ""
"\n"
"UIWebView can be susceptible to client side Javascript injection if\n"
"inputs are not properly validated. Since the code is injected on the\n"
"client side, it is possible to call native functions in the device and\n"
"perform malicious actions. Currently there are no public APIs to disable\n"
"Javascript in UIWebView.\n"
"\n"
"Furthermore, UIWebView may cache loaded data into the internal database.\n"
"This means that sensitive content remains in the memory even after it\n"
"has been closed.\n"
msgstr ""

#: vulnerabilities.py:4101
msgid ""
"\n"
"When using UIWebView, make sure the data is loaded over HTTPS. Avoid\n"
"using it to load content that depends on user input. Validate the\n"
"contents of the URL by using `dataWithContentsOfURL` from NSData. Never\n"
"use loadRequest to render local file resource as this causes a universal\n"
"Cross-Site Scripting vulnerability. Instead, use `loadHTMLString:baseURL:`.\n"
"Finally, disable caching when sensitive content is loaded.\n"
msgstr ""

#: vulnerabilities.py:4118 vulnerabilities.py:4119
msgid "WebView Exploits"
msgstr ""

#: vulnerabilities.py:4120
msgid "Are there instances of WebView used insecurely in the app?"
msgstr ""

#: vulnerabilities.py:4121
msgid "WebViews, if any, are properly implemented."
msgstr ""

#: vulnerabilities.py:4123
msgid ""
"\n"
"Android API offers WebView to deliver a web application (or just a web\n"
"page) as a part of a client app. A common scenario in which using\n"
"WebView is helpful is when you want to provide information in your\n"
"application that you might need to update, such as an end-user agreement\n"
"or a user guide. Another scenario is if your application provides data\n"
"to the user that always requires an Internet connection to retrieve\n"
"data, such as email. In this case, you might find that it's easier to\n"
"build a WebView in your Android application that shows a web page with\n"
"all the user data, rather than performing a network request, then\n"
"parsing the data and rendering it in an Android layout.\n"
msgstr ""

#: vulnerabilities.py:4135
msgid ""
"\n"
"WebView can be susceptible to various exploits including client side\n"
"Javascript injection and network sniffing if improperly implemented.\n"
msgstr ""

#: vulnerabilities.py:4139 vulnerabilities.py:4147
msgid ""
"\n"
"An improperly implemented WebView instance may be vulnerable to XSS can\n"
"be used to gain access to shared preference files using `file:///`. When\n"
"Javascript is enabled, it may allow adversaries to perform XSS attacks.\n"
"Furthermore, not loading WebView over HTTPS may allow attackers to sniff\n"
"data from network transmissions and perform Man-in-the-Middle attack by\n"
"injecting arbitrary JavaScript into the WebView.\n"
msgstr ""

#: vulnerabilities.py:4155
msgid ""
"\n"
"When using WebView, ensure the following:\n"
"\n"
"- Use WebView to load only trusted content\n"
"- Always load resources over HTTPS\n"
"- Avoid using Javascript within WebView. If Javascript is absolutely\n"
"  required, be sure that each context is escaped properly by using an\n"
"  XSS filter component such as the OWASP Java Encoder Project\n"
"- Accept only plain-text user input and sanitize it before displaying\n"
"  in WebView\n"
"\n"
msgstr ""

#: vulnerabilities.py:4176 vulnerabilities.py:4177
msgid "App Transport Security"
msgstr ""

#: vulnerabilities.py:4178
msgid "Is App Transport Security (ATS) properly configured?"
msgstr ""

#: vulnerabilities.py:4179
msgid "App Transport Security (ATS) is properly configured."
msgstr ""

#: vulnerabilities.py:4181
msgid ""
"\n"
"On Apple platforms, a networking security feature called App Transport\n"
"Security (ATS) is available to apps and app extensions, and is enabled\n"
"by default. It improves privacy and data integrity by ensuring your\n"
"app's network connections employ only industry-standard protocols and\n"
"ciphers without known weaknesses. This helps instill user trust that\n"
"your app does not accidentally leak transmitted data to malicious\n"
"parties.\n"
"\n"
"By configuring this key's value in your app's `Info.plist` file, you can\n"
"customize the security of your network connections in a variety of ways.\n"
"You can:\n"
"\n"
"- Allow insecure communication with particular servers\n"
"- Allow insecure loads for web views or for media, while maintaining ATS "
"protections elsewhere in your app\n"
"- Enable new security features such as Certificate Transparency\n"
"\n"
msgstr ""

#: vulnerabilities.py:4199
msgid ""
"\n"
"App Transport Security (ATS), which is a networking security feature\n"
"that ensures network connections employ the most secure protocols and\n"
"ciphers, was found to be misconfigured.\n"
msgstr ""

#: vulnerabilities.py:4204 vulnerabilities.py:4212
msgid ""
"\n"
"Misconfiguring App Transport Security (ATS) may lead to:\n"
"\n"
"- Triggering App Store review and requiring justification\n"
"- Data getting accidentally leaked to malicious parties during transmission\n"
"- Loss of user trust\n"
"\n"
msgstr ""

#: vulnerabilities.py:4220
msgid ""
"\n"
"App Transport Security (ATS) is enabled by default for apps linked\n"
"against the iOS 9.0 or later, as indicated by the default Boolean value\n"
"of NO for the NSAllowsArbitraryLoads key. This key is at the root level\n"
"of the NSAppTransportSecurity dictionary. With ATS enabled, HTTP\n"
"connections must use HTTPS. Attempts to connect using insecure HTTP\n"
"fail. ATS employs the Transport Layer Security (TLS) protocol version\n"
"1.2.\n"
"\n"
"The `NSAppTransportSecurity` key is available in both apps and app\n"
"extensions. Starting in iOS 10.0 and later, the following subkeys are\n"
"supported:\n"
"\n"
"- `NSAllowsArbitraryLoadsInMedia`\n"
"- `NSAllowsArbitraryLoadsInWebContent`\n"
"- `NSRequiresCertificateTransparency`\n"
"- `NSAllowsLocalNetworking`\n"
"\n"
"For detailed documentation on configuring ATS, please read [Information "
"Property List Key\n"
"Reference](https://developer.apple.com/library/content/documentation/General/"
"Reference/InfoPlistKeyReference/Articles/CocoaKeys.html#//apple_ref/doc/uid/"
"TP40009251-SW35).\n"
msgstr ""

#: vulnerabilities.py:4242
msgid ""
"\n"
"For background on secure Internet connections, please read [HTTPS Server "
"Trust\n"
"Evaluation](https://developer.apple.com/library/content/technotes/tn2232/"
"_index.html).\n"
msgstr ""

#: vulnerabilities.py:4253 vulnerabilities.py:4254
msgid "Insecure Hashing Algorithms"
msgstr ""

#: vulnerabilities.py:4255
msgid "Are any insecure hash functions used?"
msgstr ""

#: vulnerabilities.py:4256
msgid "No insecure hash functions are used."
msgstr ""

#: vulnerabilities.py:4258 vulnerabilities.py:4462
msgid ""
"\n"
"The MD5 algorithm is commonly used hash function producing a 128-bit hash "
"value.\n"
"MD5 was designed to be used as a cryptographic hash function, but can be "
"used as\n"
"a checksum to verify data integrity against unintentional corruption. "
"However, MD5\n"
"can be reversed by a brute-force attack and suffers from extensive "
"vulnerabilities.\n"
msgstr ""

#: vulnerabilities.py:4264
msgid ""
"\n"
"Using cryptographically insecure hash function algorithms may severely "
"compromise\n"
"the integrity of data.\n"
msgstr ""

#: vulnerabilities.py:4268
msgid ""
"\n"
"Using salted MD5 for passwords is a bad idea. Not because of MD5's "
"cryptographic\n"
"weaknesses, but because it is fast. This means that an attacker can try "
"billions\n"
"of candidate passwords per second on a single GPU. (See [Dangers of Weak "
"Hashes](https://www.sans.org/reading-room/whitepapers/authentication/dangers-"
"weak-hashes-34412))\n"
"\n"
"Using MD5 for file integrity may or may not be a practical problem, "
"depending on\n"
"the exact usage scenario. The attacks against MD5 are collision attacks, "
"not\n"
"pre-image attacks. This means an attacker can produce two files with the "
"same\n"
"hash, if they have control over both of them. But they can't match the hash "
"of\n"
"an existing file they didn't influence.\n"
"\n"
"Although SHA1 remains the world's widely used hashing algorithm, with Git "
"and\n"
"GnuPG relying on it for data integrity, it was recently\n"
"[proven](https://shattered.io/static/shattered.pdf) to be susceptible to "
"collision attacks.\n"
msgstr ""

#: vulnerabilities.py:4284
msgid ""
"\n"
"**For passwords**, deliberately slow hash constructions, such as scrypt, "
"bcrypt and\n"
"PBKDF2 should be used. Simple salted SHA-2 is not good enough because, like "
"most\n"
"general purpose hashes, it is fast. ([How to securely hash passwords]"
"(https://security.stackexchange.com/questions/211/how-to-securely-hash-"
"passwords))\n"
"\n"
"**For file integrity**, the current best solution is SHA-2 (SHA-256). Once "
"SHA-3 gets\n"
"standardized it will be a good choice too.\n"
msgstr ""

#: vulnerabilities.py:4301 vulnerabilities.py:4302
msgid "One Time Password Bypass"
msgstr ""

#: vulnerabilities.py:4303
msgid "Is the application vulnerable to One Time Password Bypass?"
msgstr ""

#: vulnerabilities.py:4304
msgid "Application is not vulnerable to One Time Password Bypass."
msgstr ""

#: vulnerabilities.py:4306
msgid ""
"\n"
"A one-time password (OTP) is a password that is valid for only one login "
"session or transaction.\n"
"OTPs avoid a number of shortcomings that are associated with traditional "
"(static) password-based authentication;\n"
"a number of implementations also incorporate two factor authentication by "
"ensuring that the one-time password\n"
"requires access to something a person has (such as a small keyring fob "
"device with the OTP calculator built\n"
"into it, or a smartcard or specific cellphone) as well as something a person "
"knows (such as a PIN).\n"
msgstr ""

#: vulnerabilities.py:4337 vulnerabilities.py:4338
msgid "Insecure Direct Object Reference"
msgstr ""

#: vulnerabilities.py:4339
msgid "Do Insecure Direct Object References exist within the app?"
msgstr ""

#: vulnerabilities.py:4340
msgid "No occurences of Insecure Direct Object References were found."
msgstr ""

#: vulnerabilities.py:4342
msgid ""
"\n"
"Insecure Direct Object References occur when an application provides direct "
"access to objects based on user-supplied input.\n"
"As a result of this vulnerability, attackers can bypass authorisation and "
"access resources in the system directly, by modifying\n"
"the value of a parameter used to point to an object. Such resources can be "
"database entries belonging to other users, files in the system, or others.\n"
"This is caused by the fact that the application takes user supplied input "
"and uses it to retrieve an object without performing sufficient "
"authorisation checks.\n"
msgstr ""

#: vulnerabilities.py:4375
msgid ""
"Does the application use Transport Layer protection? Is HTTPS enabled "
"globally in the application?"
msgstr ""

#: vulnerabilities.py:4376
msgid ""
"Application has SSL enabled and sufficient protection is being used to "
"prevent information leakage."
msgstr ""

#: vulnerabilities.py:4377
msgid ""
"When making network transmissions, all connections should strictly use TLS."
msgstr ""

#: vulnerabilities.py:4412
msgid ""
"\n"
"Never use just an HTTP connection to upload/download data. Instead, create "
"an HTTPS\n"
"request to perform transmission.\n"
msgstr ""

#: vulnerabilities.py:4425 vulnerabilities.py:4426
msgid "Short HMAC Keys"
msgstr ""

#: vulnerabilities.py:4427
msgid "Are keys used to calculate HMAC too short?"
msgstr ""

#: vulnerabilities.py:4428
msgid "Keys used to calculate HMAC, if any, are of recommended length."
msgstr ""

#: vulnerabilities.py:4430
msgid ""
"\n"
"An HMAC (keyed-hash message authentication code) is a type of message "
"authentication\n"
"code used to simultaneously verify both the data integrity and the "
"authentication of a message.\n"
"Any cryptographic hash function, such as MD5 or SHA-1, may be used in the "
"calculation of an HMAC;\n"
"the resulting MAC algorithm is termed HMAC-MD5 or HMAC-SHA-1 accordingly.\n"
"The cryptographic strength of the HMAC depends upon the cryptographic "
"strength of the underlying\n"
"hash function, the size of its hash output, and on the size and quality of "
"the key.\n"
msgstr ""

#: vulnerabilities.py:4438
msgid ""
"\n"
"The key for HMAC can be of any length. However, less than 32 bytes is "
"strongly discouraged\n"
"as it would decrease the security strength of the function. Keys longer than "
"64 bytes are acceptable\n"
"but the extra length would not significantly increase the function "
"strength.\n"
"A longer key may be advisable if the randomness of the key is considered "
"weak.\n"
msgstr ""

#: vulnerabilities.py:4444
msgid ""
"Loss of HMAC security may compromise the integrity and authenticity of the "
"data maintained."
msgstr ""

#: vulnerabilities.py:4457 vulnerabilities.py:4458
msgid "Vulnerable Hash Algorithms"
msgstr ""

#: vulnerabilities.py:4459
msgid "Are any deprecated or vulnerable hash algorithms used?"
msgstr ""

#: vulnerabilities.py:4460
msgid "No deprecated or vulnerable hash algorithms are being used."
msgstr ""

#: vulnerabilities.py:4468
msgid ""
"\n"
"Using salted MD5 for passwords should be avoided, not because of its "
"cryptographic\n"
"weaknesses, but because it is fast. An attacker can try billions of "
"candidate passwords\n"
"per second on a single GPU.\n"
"\n"
"Using MD5 for file integrity may or may not be a practical problem, "
"depending on\n"
"the exact usage scenario. The attacks against MD5 are collision attacks, "
"not\n"
"pre-image attacks which means an attacker can produce two files with the "
"same\n"
"hash, if they have control over both of them. However, they cannot match the "
"hash of\n"
"an existing file they didn't influence.\n"
"\n"
"Although SHA1 remains the world's widely used hashing algorithm with Git "
"and\n"
"GnuPG relying on it for data integrity, it has [also been proven](https://"
"shattered.io/static/shattered.pdf)\n"
"to be susceptible to collision attacks.\n"
msgstr ""

#: vulnerabilities.py:4483
msgid ""
"\n"
"Using cryptographically weak hash function algorithms may severely "
"compromise the integrity of data.\n"
msgstr ""

#: vulnerabilities.py:4488
msgid ""
"\n"
"**For passwords**, deliberately slow hash constructions such as scrypt, "
"bcrypt and\n"
"PBKDF2 should be used. Simple salted SHA2 is not good enough because, like "
"most\n"
"general purpose hashes, it is fast.\n"
"\n"
"**For file integrity**, the current best solution is SHA-2 (SHA-256). SHA-3 "
"will also be\n"
"a good choice once it gets standardised.\n"
msgstr ""

#: vulnerabilities.py:4505 vulnerabilities.py:4506
msgid "General Server Vulnerabilities"
msgstr ""

#: vulnerabilities.py:4507
msgid "Are any general server vulnerabilities present?"
msgstr ""

#: vulnerabilities.py:4508
msgid "No general server vulnerabilities were found."
msgstr ""

#: vulnerabilities.py:4510
msgid ""
"\n"
"This issue is not specific to a certain kind of vulnerabilities. It can be "
"raised as\n"
"a result of many different types of attacks and might indicate some server-"
"side\n"
"fault that may lead to further vulnerabilities\n"
"\n"
"When an attacker explores a web site looking for vulnerabilities, the amount "
"of\n"
"information that the site provides is crucial to the eventual success or "
"failure\n"
"of any attempted attacks. If the application shows the attacker a stack "
"trace,\n"
"it relinquishes information that makes the attacker's job significantly "
"easier.\n"
"For example, a stack trace might show the attacker a malformed SQL query "
"string,\n"
"the type of database being used, and the version of the application "
"container.\n"
"This information enables the attacker to target known vulnerabilities in "
"these components.\n"
"\n"
"The application configuration should specify a default error page in order "
"to\n"
"guarantee that the application will never leak error messages to an "
"attacker.\n"
"Handling standard HTTP error codes is useful and user-friendly in addition "
"to\n"
"being a good security practice, and a good configuration will also define a\n"
"last-chance error handler that catches any exception that could possibly be\n"
"thrown by the application.\n"
msgstr ""

#: vulnerabilities.py:4530
msgid ""
"\n"
"The API may be susceptible to general server vulnerabilities, which can lead "
"to\n"
"further attacks\n"
msgstr ""

#: vulnerabilities.py:4547 vulnerabilities.py:4548
msgid "Buffer Overflow Vulnerabilities in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4549
msgid "Did buffer overflows occur in HTTP requests?"
msgstr ""

#: vulnerabilities.py:4550
msgid "Buffer overflow vulnerabilities were not detected in HTTP request."
msgstr ""

#: vulnerabilities.py:4552
msgid ""
"\n"
"A buffer overflow occurs when a program attempts to put more data in a "
"buffer than\n"
"it can hold or when a program attempts to put data in a memory area past a "
"buffer.\n"
"In this case, a buffer is a sequential section of memory allocated to "
"contain anything\n"
"from a character string to an array of integers. Writing outside the bounds "
"of a\n"
"block of allocated memory can corrupt data, crash the program, or cause the "
"execution of malicious code.\n"
"\n"
"Attackers use buffer overflows to corrupt the execution stack of a web "
"application.\n"
"By sending carefully crafted input to a web application, an attacker can "
"cause the\n"
"web application to execute arbitrary code.\n"
"\n"
"Buffer overflow flaws can be present in both the web server or application "
"server\n"
"products that serve the static and dynamic aspects of the site, or the web "
"application itself.\n"
msgstr ""

#: vulnerabilities.py:4566
msgid ""
"\n"
"One or more API requests may be vulnerable to Buffer overflow issues\n"
msgstr ""

#: vulnerabilities.py:4569
msgid ""
"\n"
"- Buffer overflows generally lead to crashes. Other attacks leading to lack "
"of\n"
"  availability are possible, including putting the program into an infinite "
"loop.\n"
"- Buffer overflows often can be used to execute arbitrary code, which is "
"usually\n"
"  outside the scope of a program’s implicit security policy.\n"
"- When the consequence is arbitrary code execution, this can often be used "
"to\n"
"  subvert any other security service.\n"
msgstr ""

#: vulnerabilities.py:4589 vulnerabilities.py:4590
msgid "Command Injection Vulnerabilities in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4591
msgid "Are there command injection vulnerabilities in HTTP request?"
msgstr ""

#: vulnerabilities.py:4592
msgid "No command injection vulnerabilities in HTTP request were found."
msgstr ""

#: vulnerabilities.py:4594
msgid ""
"\n"
"Command injection is an attack in which the attacker attempts execution of "
"arbitrary commands\n"
"on the host operating system via a vulnerable application. This attack "
"differs from Code Injection,\n"
"in that code injection allows the attacker to add his own code that is then "
"executed by the application.\n"
"In Code Injection, the attacker extends the default functionality of the "
"application\n"
"without the necessity of executing system commands.\n"
"\n"
"Command injection attacks are possible when an application passes unsafe "
"user supplied data\n"
"(forms, cookies, HTTP headers etc.) to a system shell. The attacker-"
"supplied\n"
"operating system commands are usually executed with the privileges of the "
"vulnerable application.\n"
"Command injection attacks are possible largely due to insufficient input "
"validation.\n"
msgstr ""

#: vulnerabilities.py:4606
msgid ""
"\n"
"One or more API requests were found to be vulnerable to command injection "
"vulnerabilities\n"
msgstr ""

#: vulnerabilities.py:4622 vulnerabilities.py:4623
msgid "Integer Overflow Vulnerabilities in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4624
msgid "Are there integer overflow vulnerabilities in HTTP request?"
msgstr ""

#: vulnerabilities.py:4625
msgid "No integer overflow vulnerabilities were found in HTTP request."
msgstr ""

#: vulnerabilities.py:4627
msgid ""
"\n"
"An integer overflow occurs when the result of an arithmetic operation "
"exceeds the maximum size\n"
"of the integer data type used to store it. When an integer overflow occurs, "
"the calculated value\n"
"will wrapped around the maximum value allowed by the data structure and "
"start from the minimum value.\n"
"\n"
"Attackers use integer overflows to corrupt the data stack of the web "
"application.\n"
"By sending carefully crafted input to the server, an attacker can cause the "
"data corruption.\n"
"Attackers can use these defects to influence the value of variables in ways "
"that the application is not meant\n"
"to.\n"
msgstr ""

#: vulnerabilities.py:4637
msgid ""
"\n"
"The API may be vulnerable to integer overflow issues\n"
msgstr ""

#: vulnerabilities.py:4640
msgid ""
"\n"
"- An integer overflow during a buffer length calculation can result in "
"allocating a buffer that\n"
"is too small to hold the data to be copied into it. This in turn can cause a "
"buffer overflow when the data is copied.\n"
"- Withdrawing 1 unit from an account with a balance of 0 could cause an "
"integer underflow and yield\n"
"a new balance of 4,294,967,295.\n"
"- A very large positive number in a transaction could be cast as a signed "
"integer by backend. The interpreted value\n"
"could become a negative number and reverse the direction of the "
"transaction.\n"
msgstr ""

#: vulnerabilities.py:4660 vulnerabilities.py:4661
msgid "JSON Depth Overflow in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4662
msgid "Are there JSON depth overflows in HTTP requests?"
msgstr ""

#: vulnerabilities.py:4663
msgid "No JSON depth overflows were found in HTTP request."
msgstr ""

#: vulnerabilities.py:4665
msgid ""
"\n"
"Altough JSON is intended as a data serialization format, its design as a\n"
"non-strict subset of the JavaScript scripting language poses several "
"security\n"
"concerns, which are centered on the use of a JavaScript interpreter to "
"execute\n"
"JSON text dynamically as embedded JavaScript. This easy and popular but "
"risky\n"
"technique exploits JSON's compatibility with the JavaScript `eval()` "
"function.\n"
"It is possible that the JSON parser will reach depth limit and crash,\n"
"resulting in a successful overflow of the JSON parsers depth limit, leading\n"
"to a DoS vulnerability.\n"
msgstr ""

#: vulnerabilities.py:4675
msgid ""
"\n"
"The JSON parser used by the API may be vulnerable to depth overflow issues\n"
msgstr ""

#: vulnerabilities.py:4691 vulnerabilities.py:4692
msgid "LDAP Injection Vulnerabilities in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4693
msgid "Are there LDAP injection vulnerabilities in HTTP request?"
msgstr ""

#: vulnerabilities.py:4694
msgid "No LDAP injection vulnerabilities were found in HTTP request."
msgstr ""

#: vulnerabilities.py:4696
msgid ""
"\n"
"LDAP injection is an attack used to exploit web based applications that "
"construct\n"
"LDAP statements based on user input. When an application fails to properly\n"
"sanitize user input, it is possible to modify LDAP statements using a local "
"proxy.\n"
"This could result in the execution of arbitrary commands such as granting "
"permissions\n"
"to unauthorized queries, and content modification inside the LDAP tree. The "
"same\n"
"advanced exploitation techniques available in SQL injection can be "
"similarly\n"
"applied in LDAP injection.\n"
msgstr ""

#: vulnerabilities.py:4705
msgid ""
"\n"
"The API may be vulnerable to LDAP injection\n"
msgstr ""

#: vulnerabilities.py:4721 vulnerabilities.py:4722
msgid "Regex DoS Vulnerabilities in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4723
msgid "Are there Regex DoS vulnerabilities in HTTP requests?"
msgstr ""

#: vulnerabilities.py:4724
msgid "No Regex DoS vulnerabilities were found in HTTP request."
msgstr ""

#: vulnerabilities.py:4726
msgid ""
"\n"
"The Regular Expression Denial of Service (ReDoS) is a Denial of Service "
"attack,\n"
"that exploits the fact that most Regular Expression implementations may "
"reach\n"
"extreme situations that cause them to work very slowly (exponentially "
"related\n"
"to input size). An attacker can then cause a program using a regular "
"expression\n"
"to enter these extreme situations and then hang for a very long time.\n"
msgstr ""

#: vulnerabilities.py:4733
msgid ""
"\n"
"Instances of Regex DoS vulnerabilities were found in API requests\n"
msgstr ""

#: vulnerabilities.py:4749 vulnerabilities.py:4750
msgid "SQL Injection Vulnerabilities in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4751
msgid "Are there SQL injection vulnerabilities in HTTP request?"
msgstr ""

#: vulnerabilities.py:4752
msgid "No SQL injection vulnerabilities were found in HTTP request."
msgstr ""

#: vulnerabilities.py:4754
msgid ""
"\n"
"A SQL injection attack consists of insertion or _injection_ of a SQL query "
"via\n"
"the input data from the client to the application. A successful SQL "
"injection\n"
"exploit can read sensitive data from the database, modify database data\n"
"(Insert/Update/Delete), execute administration operations on the database\n"
"(such as shutdown the DBMS), recover the content of a given file present on "
"the\n"
"DBMS file system and in some cases issue commands to the operating system.\n"
"SQL injection attacks are a type of injection attack, in which SQL commands "
"are\n"
"injected into data-plane input in order to effect the execution of "
"predefined SQL commands.\n"
msgstr ""

#: vulnerabilities.py:4764
msgid ""
"\n"
"One or more API requests were found to be vulnerable to SQL injection\n"
msgstr ""

#: vulnerabilities.py:4782
msgid "Is PhoneGap debug logging enabled?"
msgstr ""

#: vulnerabilities.py:4783
msgid ""
"PhoneGap debug logging was found to be disabled or PhoneGap is not being "
"used."
msgstr ""

#: vulnerabilities.py:4785
msgid ""
"\n"
"If a PhoneGap app is shipped with debug mode switched on, it can allow "
"anyone to\n"
"attach a debugger and change the logical flow of the app. Sensitive logs "
"get\n"
"leaked which can be used to determine the URL endpoints of the application.\n"
msgstr ""

#: vulnerabilities.py:4790
msgid ""
"\n"
"When using PhoneGap, disable debug logs before shipping the app.\n"
msgstr ""

#: vulnerabilities.py:4793
msgid ""
"\n"
"If a PhoneGap app is shipped with debug mode switched on, it can allow "
"anyone\n"
"to attach a debugger and change the logical flow of the app. Sensitive logs "
"get\n"
"leaked which can be used to determine the URL endpoints of the application.\n"
msgstr ""

#: vulnerabilities.py:4802
msgid ""
"\n"
"\n"
"If using PhoneGap, please turn of all `console.logs()` and other logging\n"
"code before publishing.\n"
msgstr ""

#: vulnerabilities.py:4817 vulnerabilities.py:4818
msgid "String Validation Vulnerabilities in HTTP Requests"
msgstr ""

#: vulnerabilities.py:4819
msgid "Are there string validation vulnerabilities in HTTP request?"
msgstr ""

#: vulnerabilities.py:4820
msgid "No string validation vulnerabilities were found in HTTP requests."
msgstr ""

#: vulnerabilities.py:4822
msgid ""
"\n"
"Failure to properly validate input from the client or environment is the "
"most\n"
"common web application security weakness. This leads to almost all of the "
"major\n"
"vulnerabilities in applications, such as Interpreter Injection, locale/"
"Unicode attacks,\n"
"file system attacks and buffer overflows. Data from the client should never "
"be\n"
"trusted for the client has every possibility to tamper with the data.\n"
msgstr ""

#: vulnerabilities.py:4829
msgid ""
"\n"
"Appknox found string validation vulnerabilities in one or more HTTP "
"requests\n"
msgstr ""

#: vulnerabilities.py:4845 vulnerabilities.py:4846
msgid "XML-external-entity Injection Vulnerabilities in HTTP Body"
msgstr ""

#: vulnerabilities.py:4847
msgid "Are there XML-external-entity injection vulnerabilities in HTTP body?"
msgstr ""

#: vulnerabilities.py:4848
msgid ""
"No XML-external-entity injection vulnerabilities were found in HTTP body."
msgstr ""

#: vulnerabilities.py:4850
msgid ""
"\n"
"An XML External Entity Injection is a type of attack against an application "
"that\n"
"parses XML input. This attack occurs when XML input containing a reference "
"to an\n"
"external entity is processed by a weakly configured XML parser. This attack "
"may\n"
"lead to the disclosure of confidential data, denial of service, server side "
"request\n"
"forgery, port scanning from the perspective of the machine where the parser "
"is\n"
"located, and other system impacts.\n"
msgstr ""

#: vulnerabilities.py:4858
msgid ""
"\n"
"Our scanner detected occurrences of XML-external-entity injection "
"vulnerabilities\n"
"in HTTP body of API calls\n"
msgstr ""

#: vulnerabilities.py:4875 vulnerabilities.py:4876
msgid "Cross-site-scripting Vulnerabilities in HTTP Body"
msgstr ""

#: vulnerabilities.py:4877
msgid "Are there cross-site-scripting vulnerabilities in HTTP body?"
msgstr ""

#: vulnerabilities.py:4878
msgid "No Cross-site-scripting vulnerabilities were found in HTTP body."
msgstr ""

#: vulnerabilities.py:4880
msgid ""
"\n"
"Cross-Site Scripting (XSS) attacks are a type of injection, in which "
"malicious\n"
"scripts are injected into otherwise benign and trusted web sites. XSS "
"attacks\n"
"occur when an attacker uses a web application to send malicious code, "
"generally\n"
"in the form of a browser side script, to a different end user. Flaws that "
"allow\n"
"these attacks to succeed are quite widespread and occur anywhere a web "
"application\n"
"uses input from a user within the output it generates without validating or "
"encoding it.\n"
"\n"
"An attacker can use XSS to send a malicious script to an unsuspecting user. "
"The\n"
"end user's browser has no way to know that the script should not be "
"trusted,\n"
"and will execute the script. Because it thinks the script came from a "
"trusted\n"
"source, the malicious script can access any cookies, session tokens, or "
"other\n"
"sensitive information retained by the browser and used with that site.\n"
"These scripts can even rewrite the content of the HTML page.\n"
"\n"
"The impace of XSS attacks may range from a petty nuisance to a significant\n"
"security risk, depending on the sensitivity of the data handled by the\n"
"vulnerable site and the nature of any security mitigation implemented by "
"the\n"
"site's owner.\n"
msgstr ""

#: vulnerabilities.py:4900
msgid ""
"\n"
"One or more API calls were found to be vulnerable to Cross-Site Scripting "
"(XSS) attacks\n"
msgstr ""

#: vulnerabilities.py:4916 vulnerabilities.py:4917
msgid "CORS Wild Character Vulnerabilities in HTTP Headers"
msgstr ""

#: vulnerabilities.py:4918
msgid "Are there CORS wild character vulnerabilities in HTTP header?"
msgstr ""

#: vulnerabilities.py:4919
msgid "No CORS wild character vulnerabilities were found in HTTP headers."
msgstr ""

#: vulnerabilities.py:4921
msgid ""
"\n"
"Cross Origin Resource Sharing (CORS) is a specification that allows cross "
"domain\n"
"communication in a web browser. It works by defining new HTTP headers that "
"describe\n"
"the origins that are allowed cross domain information transmission, thus "
"allowing\n"
"restricted resources (e.g. fonts) on a web page to be requested from "
"another\n"
"domain outside the domain from which the first resource was served.\n"
"\n"
"`Access-Control-Allow-Origin` header should be never set to `*` especially "
"if the resource\n"
"contains sensitive information. It should be set to allow requests only from "
"the\n"
"domains that are trusted.\n"
msgstr ""

#: vulnerabilities.py:4932
msgid ""
"\n"
"One or more API requests were found to have CORS wild character "
"vulnerability within in HTTP headers\n"
msgstr ""

#: vulnerabilities.py:4947 vulnerabilities.py:4948
msgid "PhoneGap Whitelist Open Access"
msgstr ""

#: vulnerabilities.py:4949
msgid "Does PhoneGap whitelist allow open access or is missing?"
msgstr ""

#: vulnerabilities.py:4950
msgid "PhoneGap whitelist does not allow open acces.s or PhoneGap is not used"
msgstr ""

#: vulnerabilities.py:4953
msgid ""
"\n"
"Domain whitelisting is a security model that controls access to external "
"domains\n"
"over which the app has no control. The default security policy allows access "
"to\n"
"any site. Before moving your application to production, you should "
"formulate\n"
"a whitelist and allow access to specific network domains and subdomains.\n"
"\n"
"Application Transport Security (ATS) is a new feature in iOS 9 that acts as\n"
"a whitelist for the app. The all `<access>` and `<allow-navigation>` tags\n"
"automatically get converted to the appropriate ATS directives.\n"
msgstr ""

#: vulnerabilities.py:4963
msgid ""
"\n"
"The PhoneGap whitelist was found to be allowing open access to all sites.\n"
"Do not use wildcards (*) alone in whitelists, use fully qualified "
"hostnames.\n"
msgstr ""

#: vulnerabilities.py:4967 vulnerabilities.py:5067
msgid ""
"\n"
"An attacker can bypass the whitelisting mechanism and initiate connections "
"to\n"
"unauthorized remote servers. This could aid in further attacks.\n"
msgstr ""

#: vulnerabilities.py:4983 vulnerabilities.py:4984
msgid "Cross Site Tracing Vulnerabilities"
msgstr ""

#: vulnerabilities.py:4985
msgid "Are there Cross Site Tracing vulnerabilities present?"
msgstr ""

#: vulnerabilities.py:4986
msgid "No Cross Site Tracing vulnerabilities were found."
msgstr ""

#: vulnerabilities.py:4988
msgid ""
"\n"
"A Cross-Site Tracing (XST) attack involves the use of Cross-site Scripting "
"(XSS)\n"
"and the TRACE or TRACK HTTP methods to be successfully leveraged in some\n"
"scenarios to steal legitimate users' credentials. This attack technique was\n"
"discovered by Jeremiah Grossman in 2003, in an attempt to bypass the "
"HttpOnly\n"
"tag that Microsoft introduced in Internet Explorer 6 SP1 to protect cookies "
"from\n"
"being accessed by JavaScript.\n"
msgstr ""

#: vulnerabilities.py:4996
msgid ""
"\n"
"One or more API requests were found to be susceptible to Cross Site Tracing "
"vulnerabilies\n"
msgstr ""

#: vulnerabilities.py:4999
msgid ""
"\n"
"The Cross-Site Tracing (XST) attack makes use of Cross-site Scripting (XSS)\n"
"and the TRACE or TRACK HTTP methods. TRACE allows the client to see what is\n"
"being received at the other end of the request chain and use that data for\n"
"testing or diagnostic information. The TRACK method works in the same way "
"but\n"
"is specific to Microsoft's IIS web server. XST could be used as a method to\n"
"steal user's cookies via Cross-site Scripting (XSS) even if the cookie has "
"the\n"
"`HttpOnly` flag set and/or exposes the user's Authorization header.\n"
"\n"
"Modern browsers now prevent TRACE requests being made via JavaScript, "
"however,\n"
"other ways of sending TRACE requests with browsers have been discovered, "
"such as using Java.\n"
msgstr ""

#: vulnerabilities.py:5023 vulnerabilities.py:5024
msgid "Response Body Contains Non-HTTPS Links"
msgstr ""

#: vulnerabilities.py:5025
msgid "Does any response body contain non-https links?"
msgstr ""

#: vulnerabilities.py:5026
msgid "Response body does not contain non-https links."
msgstr ""

#: vulnerabilities.py:5028
msgid ""
"\n"
"When a response is served over HTTPS, the connection with the web server\n"
"is encrypted with TLS and is therefore safeguarded from sniffers and man-in-"
"the-middle\n"
"attacks. If the HTTPS response includes links to content that is\n"
"retrieved through regular, cleartext HTTP, then the connection is only "
"partially\n"
"encrypted; the unencrypted content is accessible to sniffers and can be "
"modified\n"
"by man-in-the-middle attackers, so the connection is not safeguarded.\n"
msgstr ""

#: vulnerabilities.py:5036
msgid ""
"\n"
"One or more of the API responses were found to contain URL links that do not "
"employ HTTPS,\n"
"ie. that use regular, cleartext HTTP.\n"
msgstr ""

#: vulnerabilities.py:5052 vulnerabilities.py:5053
msgid "PhoneGap Whitelist RegEx Bypass"
msgstr ""

#: vulnerabilities.py:5054
msgid "Can the PhoneGap whitelist be bypassed with a special RegEx"
msgstr ""

#: vulnerabilities.py:5055
msgid ""
"The app does not allow whitelist to be bypassed, or PhoneGap is not used."
msgstr ""

#: vulnerabilities.py:5057
msgid ""
"\n"
"Domain whitelisting is a security model that controls access to external "
"domains\n"
"over which the app has no control. The default security policy allows access "
"to\n"
"any site. Before moving your application to production, you should "
"formulate\n"
"a whitelist and allow access to specific network domains and subdomains.\n"
msgstr ""

#: vulnerabilities.py:5063
msgid ""
"\n"
"If a regular expression is used within the whitelist, check if HTTPS can be\n"
"bypassed with the regex.\n"
msgstr ""
