Design/Logic Flaw

The Norwegian Air Shuttle aka norwegian.com airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to...

CVE-2017-5634

The Norwegian Air Shuttle aka norwegian.com airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to...

CVE-2017-5634

The Norwegian Air Shuttle aka norwegian.com airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to...

CVE-2017-5634

CVE-2017-5634 affects the Norwegian Air Shuttle airline kiosk. Affected component is the kiosk software used for bookings; root cause is an authentication bypass that lets physically proximate attackers manipulate the print dialog via the touch-screen print icon, bypassing the UI step and potenti...

Citrix Receiver Kiosk mode

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. StoreFront 3.6 Question: Often the customers who are in hospital environment have the question that ...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 53.0.2785.103 Platform version: 8530.81.0 for all Chrome OS devices except Google Chromebook Pixel 2015, Acer Chromebook R11, ASUS Chromebook Flip C100PA, HP Chromebox CB1, and Acer C7 Chromebook. This build contains a number of bug fixes, security updates,...

SQL Injection Vulnerability in the Keyword Parameter of Digital Newspaper System of Joyful Reading Kiosk

Joyful Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. A SQL injection vulnerability exists in the keyword parameter of the Joyfully Reading Kiosk Digital Newspaper System. An attacker can exploit the vulnerability to obtain database information...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 52.0.2743.116 Platform version: 8350.68.0 for all Chrome OS devices. This build contains a number of bug fixes, security updates, and feature enhancements. Systems will be receiving updates over the next several days. Some highlights of these changes are:...

Stable Channel Update for Chrome OS

The Stable channel has been updated to 52.0.2743.116 Platform version: 8350.68.0 for all Chrome OS devices. This build contains a number of bug fixes, security updates, and feature enhancements. Systems will be receiving updates over the next several days. Some highlights of these changes are:...

[SECURITY] Fedora 23 Update: xguest-1.0.10-33.fc23

Installing this package sets up the xguest user to be used as a temporary account to switch to or as a kiosk user account. The account is disabled un less SELinux is in enforcing mode. The user is only allowed to log in via graphi cal login program. The home and temporary directories of the user...

[SECURITY] Fedora 24 Update: xguest-1.0.10-34.fc24

Installing this package sets up the xguest user to be used as a temporary account to switch to or as a kiosk user account. The account is disabled un less SELinux is in enforcing mode. The user is only allowed to log in via graphi cal login program. The home and temporary directories of the user...

BVB-Kiosk - Customized SSL, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application BVB-Kiosk published at the 'play' market has multiple vulnerabilities...

Kiosk Browser Lockdown - Dangerous filesystem permissions, MIT license, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Kiosk Browser Lockdown published at the 'play' market has multiple vulnerabilities...

Monkey race ray! RSA conference badge scanning application broke vulnerability-vulnerability warning-the black bar safety net

Recently, the BLUE BOX company's security researchers found: RSA 2 0 1 6 The General Assembly on the use of badge scanning APP there is a hard-coded default passwords. This year, RSA 2 0 1 6 The participants will get a unique surprise: the General Assembly, as many manufacturers offer a Samsung...

Enter: Potential for financial loss, negative Values for "Buy fee" and "Sell Fee"

Issue It is possible to set negative values for the Buy Fee and Sell Fee, which will cause unexpected transfers etc. as these settings override the settings at the location. PoC 1. Go to the Operator Wallet's Settings. 2. Click on the users tab. 3. Select any user. 4. Go to settings tab of that...

WordPress Kiosk Prox Plugin - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

CVE-2014-7612

The e-Kiosk aka com.ekioskreader.android.pdfviewer application 1.74 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The e-Kiosk aka com.ekioskreader.android.pdfviewer application 1.74 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Kontan Kiosk aka com.appsfoundry.scoopwl.id.kontankiosk application @7F07025E for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7494

CVE-2014-7494 concerns the Kontan Kiosk Android app (package com.appsfoundry.scoopwl.id.kontankiosk). The provided documents state the app does not verify X.509 certificates from SSL servers, which can let a man-in-the-middle attacker spoof servers and obtain sensitive information via a crafted c...