Mobileiron

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-3391 1Mobileiron 1Mobile@work Jun 17, 2026 Mar 29, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 MobileIron Mobile@Work through 2021-03-22 allows attackers to distinguish among valid, disabled, and nonexistent user accounts by observing the number of failed login attempts needed to produce a Lockout error message
CVE-2020-35138 1Mobileiron 1Mobile@work Jun 17, 2026 Mar 29, 2021 N/A· v4 9.8 CRITICAL· v3 5.0 MEDIUM· v2 The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Wo...Show more The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded encryption key, used to encrypt the submission of username/password details during the authentication process, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in the com/mobileiron/common/utils/C4928m.java file. NOTE: It has been asserted that there is no causality or connection between credential encryption and the MiTM attackShow less
CVE-2020-35137 1Mobileiron 1Mobile@work Jun 17, 2026 Mar 29, 2021 N/A· v4 7.5 HIGH· v3 4.3 MEDIUM· v2 The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in com...Show more The MobileIron agents through 2021-03-22 for Android and iOS contain a hardcoded API key, used to communicate with the MobileIron SaaS discovery API, as demonstrated by Mobile@Work (aka com.mobileiron). The key is in com/mobileiron/registration/RegisterActivity.java and can be used for api/v1/gateway/customers/servers requests. NOTE: Vendor states that this is an opt-in feature to the product - it is not enabled by default and customers cannot enable it without an explicit email to support. At this time, they do not plan change to make any changes to this feature.Show less
CVE-2020-15507 1Mobileiron 5Cloud CoreEnterprise Connector+2 more Jun 17, 2026 Jul 7, 2020 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to read files on the system v...Show more An arbitrary file reading vulnerability in MobileIron Core versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to read files on the system via unspecified vectors.Show less
CVE-2020-15506 1Mobileiron 5Cloud CoreEnterprise Connector+2 more Jun 17, 2026 Jul 7, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to bypass authenti...Show more An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0 that allows remote attackers to bypass authentication mechanisms via unspecified vectors.Show less
CVE-2020-15505 1Mobileiron 4Core Enterprise ConnectorMonitor And Reporting Database+1 more Jun 17, 2026 Jul 7, 2020 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8....Show more A remote code execution vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0, 10.5.2.0 and 10.6.0.0; and Sentry versions 9.7.2 and earlier, and 9.8.0; and Monitor and Reporting Database (RDB) version 2.0.0.1 and earlier that allows remote attackers to execute arbitrary code via unspecified vectors.Show less
CVE-2013-7287 1Mobileiron 2Sentry Virtual Smartphone Platform Nov 21, 2024 Feb 13, 2020 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 MobileIron VSP < 5.9.1 and Sentry < 5.0 has an insecure encryption scheme.
CVE-2014-1409 1Mobileiron 2Sentry Virtual Smartphone Platform Nov 21, 2024 Jan 8, 2020 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 MobileIron VSP versions prior to 5.9.1 and Sentry versions prior to 5.0 have an authentication bypass vulnerability due to an XML file with obfuscated passwords
CVE-2014-5903 1Mobileiron 1Mobile@work May 6, 2026 Sep 15, 2014 N/A· v4 N/A· v3 5.4 MEDIUM· v2 The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via...Show more The Mobile@Work (aka com.mobileiron) application 6.0.0.1.12R for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.Show less