CVE-2016-4686

CVE-2016-4686 affects iOS prior to 10.1 in the Contacts component. The issue is an access-control flaw where an application may maintain access to the Address Book after the user revokes it in Settings. The root cause is not fully detailed in the provided documents, but Apple’s iOS 10.1 security ...

Vimeo: API: missing invalidation of OAuth2 Authorization Code during access revocation causes authorization bypass

OAuth2 API makes it possible for users to grant access to their accounts to some third-side applications. Of course, users are able to manage such applications' access to their accounts and may deny access for any application. When some user denies access for the application, all accesstokens are...