CVE-2022-1959

AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations...

Authentication flaw

AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations...

CVE-2022-1959

AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations...

CVE-2022-1959

CVE-2022-1959 affects AppLock version 7.9.29, where biometric authentication can be bypassed by an attacker with physical access due to improper fingerprint validation. Multiple connected sources corroborate the flaw in AppLock 7.9.29 and describe the impact as bypassing biometric auth. Reported ...

PT-2022-14219 · Applock · Applock

Name of the Vulnerable Software and Affected Versions: AppLock version 7.9.29 Description: The issue allows an attacker with physical access to the device to bypass biometric authentication due to incorrect implementation of fingerprint validations. Recommendations: For AppLock version 7.9.29,...

Spsoft APPLOCK安全漏洞

Spsoft APPLOCK is an APP lock from Spsoft. The application is protected using passwords and fingerprints. A security vulnerability exists in Spsoft APPLOCK version 7.9.29 that stems from the application not properly implementing fingerprint authentication...

Malicious code in navigator-fingerprint-front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5cf3b70412cdf56ecfd84e0cc4a5e40cf0df3251985bc497e368e9dd1894c78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4787 Malicious code in navigator-fingerprint-front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5cf3b70412cdf56ecfd84e0cc4a5e40cf0df3251985bc497e368e9dd1894c78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-23690

A vulnerability in the web-based management interface of AOS-CX could allow a remote unauthenticated attacker to fingerprint the exact version AOS-CX running on the switch. This allows an attacker to retrieve information which could be used to more precisely target the switch for further...

CVE-2022-23690

The CVE-2022-23690 entry covers a vulnerability in the web-based management interface of Aruba AOS-CX that allows a remote, unauthenticated attacker to fingerprint the exact AOS-CX version running on a switch, enabling targeted follow-on actions. Affected ArubaOS-CX Switches and versions include ...

Zulip 安全漏洞

Zulip is a powerful open source group chat application from the Zulip team. It is used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations. Zulip suffers from a security vulnerability that stems from the fact that an attacker who can send a message...

Spying on the spies. See what JavaScript commands get injected by in-app browsers

Developer and privacy expert Felix Krause aka KrauseFx announced this week that he had introduced a simple tool to list the JavaScript commands executed by iOS apps when they deployed an in-app web browser to render webpages. He already shared some eye-opening results on his Twitter feed. By...

Threat Source newsletter (Aug. 18, 2022) — Why aren't Lockdown modes the default setting on phones?

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. As the data privacy landscape gets increasingly murky, app developers and device manufacturers are finding new ways to sure up users’ personal information. Of course, all users have to do is go out of their way to...

CVE-2022-20377

In TBD of keymasteripc.cpp, there is a possible to force gatekeeper, fingerprint, and faceauth to use a known HMAC key. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Androi...

Design/Logic Flaw

In TBD of keymasteripc.cpp, there is a possible to force gatekeeper, fingerprint, and faceauth to use a known HMAC key. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Androi...

PT-2022-14602 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: In the keymaster ipc.cpp, there is a possibility to force gatekeeper, fingerprint, and faceauth to use a known HMAC key. This could lead to local escalation of privilege with no...

USN-5160-1: Midnight Commander vulnerability

It was discovered that Midnight Commander would not check server fingerprints when establishing an SFTP connection. If a remote attacker were able to intercept communications this flaw could be exploited to impersonate the SFTP server...

CVE-2022-2095

An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint a...

UBUNTU-CVE-2022-2095

An improper access control check in GitLab CE/EE affecting all versions starting from 13.7 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1 allows a malicious authenticated user to view a public project's Deploy Key's public fingerprint a...

GitLab CE/EE 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab CE/EE that stems from improper acces...