CVE-2018-12271

An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric TouchID validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. In...

CVE-2018-12271

Affected software: com.getdropbox.Dropbox app for iOS, version 100.2. Root cause: The LAContext Biometric (TouchID) validation can be bypassed by overriding the LAContext return value to true because kSecAccessControlUserPresence is not used. This enables authentication with an arbitrary fingerpr...

PT-2018-11092 · Dropbox · Dropbox

Name of the Vulnerable Software and Affected Versions: com.getdropbox.Dropbox app version 100.2 for iOS Description: An issue in the LAContext class for Biometric TouchID validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the...

Seven security tips for staying safe on an iPhone

iPhones have a reputation for being notoriously secure. After all, they caused quite the kerfuffle between Apple and the FBI because they are, from the FBI's point of view, too secure! However, don't let that lull you into a false sense of security. Using an iPhone is not an automatic guarantee o...

Securing financial data of the future: behavioral biometrics explained

Some of us would be pretty excited about a brave, new passwordless world. Gone would be the days of having to write down 27 passwords and post them beside monitor screens. Or having to yell them out loud to a colleague on the other side of the room. For banks and other financial institutions, a...

Yet Another Biometric: Ear Shape

This acoustic technology identifies individuals by their ear shapes. No information about either false positives or false negatives...

Banknotes Misproduction security & biometric weakness

Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2105 Download: https://www.vulnerability-lab.com/resources/documents/7692342363856723534.rar Release Date: ============= 2018-01-29...

Banknotes Misproduction security & biometric weakness

Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2106 Video: https://www.youtube.com/watch?v=ORbU8fyhkgY Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2105 Vulnerabilit...

Banknotes Misproduction security & biometric weakness

Document Title: =============== Banknotes Misproduction security & biometric weakness References: =========== https://www.vulnerability-lab.com/getcontent.php?id=2106 Video: https://www.youtube.com/watch?v=ORbU8fyhkgY Advisory: https://www.vulnerability-lab.com/getcontent.php?id=2105 Vulnerabilit...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01395)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited via the LastName parameter in the index.php?user=ajax request...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01399)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited to conduct a cross-site scripting attack via the expensename parameter in the...

Biometric Shift Employee Management System Arbitrary File Download Vulnerability

Biometric Shift Employee Management System is an employee management system. An arbitrary file download vulnerability exists in Biometric Shift Employee Management System. An attacker can download arbitrary files via a directory traversal sequence in the index.php formfilename parameter of the...

Biometric Shift Employee Management System Cross-Site Request Forgery Vulnerability

Biometric Shift Employee Management System is an employee management system. A cross-site request forgery vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited to conduct cross-site request forgery attacks via index.php in the editholiday operation...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01396)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited to conduct cross-site scripting attacks via the criteria parameter in the...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability (CNVD-2018-01397)

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited via the amount parameter in the index.php?user=additiondeduction request...

Biometric Shift Employee Management System Cross-Site Scripting Vulnerability

Biometric Shift Employee Management System is an employee management system. A cross-site scripting vulnerability exists in Biometric Shift Employee Management System. The vulnerability can be exploited via the index.php holidayname parameter in the editholiday operation...

CVE-2017-17990

Biometric Shift Employee Management System has CSRF via index.php in an editholiday action...

Cross site request forgery (csrf)

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

CVE-2017-17993

Biometric Shift Employee Management System has XSS via the amount parameter in an index.php?user=additiondeduction request...

Directory traversal

Biometric Shift Employee Management System allows Arbitrary File Download via directory traversal sequences in the index.php formfilename parameter in a downloadform action...