APPLE-SA-2015-01-27-2 iOS 8.1.3

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2015-01-27-2 iOS 8.1.3 iOS 8.1.3 is now available and addresses the following: AppleFileConduit Available for: iPhone 4s and later, iPod touch 5th generation and later, iPad 2 and later Impact: A maliciously crafted afc command may allow acce...

EUVD-2014-4419

libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an networkd context via a crafted XPC message from a sandboxed app, as demonstrated by la...

iOS 8.1.2 Mail.app Injection - Load remote content without user interaction

This exploit allows an attacker to load remote website inside iOS's native Mail.app without any user interaction other than opening the HTML e-mail message containing the payload. Example: After opening the malicious message: http://i.imgur.com/GPMqdOv.jpg iPhone http://i.imgur.com/zJ7W24N.jpg iP...

Apple Offers Lukewarm Response to Masque Vulnerability

Apple said it is not aware of any customers affected by the Masque vulnerability disclosed earlier this week, and made no mention of a timeline when it might release an update patching the security hole. Masque is a vulnerability in iOS 7.1.1 and up that puts Apple mobile devices at risk to malwa...

WebDisk+ v2.1 iOS - Unrestricted File Upload Vulnerability

Document Title: =============== WebDisk+ v2.1 iOS - Unrestricted File Upload Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1349 Release Date: ============= 2014-10-23 Vulnerability Laboratory ID VL-ID: ====================================...

X (Formerly Twitter): iOS App can establish Facetime calls without user's permission

When URL Schemes for local applications are inserted in an inline frame, the web view launches them automatically. Example: Facetime Audio URL Scheme Test This page which you can also find at http://binaryfactory.ca/urlschemes/facetime.html - when loaded from Twitter on iOS including 8,...

Photorange 1.0 iOS - File Inclusion Vulnerability

No description provided by source. Document Title: =============== Photorange v1.0 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1318 Release Date: ============= 2014-09-07 Vulnerability Laboratory ID VL-ID:...

X (Formerly Twitter): User's DM won't deleted after logout from Twitter for iOS (com.atebits.xxx.application-state)

I would like to add an additional information regarding my previous report about "Unencrypted User's DM and Statuses on twitter.db at Twitter for iOS". I have already tried to logout from my Twitter apps including from built-in twitter apps for iOS, and then, I already reboot the iDevice too...

TigerCom iFolder+ 1.2 iOS - Multiple Vulnerabilities

TigerCom iFolder+ 1.2 iOS - Multiple Vulnerabilities Document Title: =============== TigerCom iFolder+ v1.2 iOS - Multiple Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1284 Release Date: ============= 2014-07-30 Vulnerability Laborator...

Researcher Identifies Hidden Data-Acquisition Services in iOS

There are a number of undocumented and hidden features and services in Apple iOS that can be used to bypass the backup encryption on iOS devices and remove large amounts of users’ personal data. Several of these features began as benign services but have evolved in recent years to become powerful...

PDF Album v1.7 iOS - File Include Web Vulnerability

Document Title: =============== PDF Album v1.7 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1255 Release Date: ============= 2014-04-11 Vulnerability Laboratory ID VL-ID: ==================================== 1255...

PDF Album 1.7 Local File Inclusion

Document Title: =============== PDF Album v1.7 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1255 Release Date: ============= 2014-04-11 Vulnerability Laboratory ID VL-ID: ==================================== 1255...

iOS 7 Bug Could Allow Background Monitoring

It’s only been a few days since Apple fixed the nasty certificate-validation “goto fail” vulnerability in iOS and OSX and now word comes that another bug, one that could allow an attacker to monitor keystrokes on iOS 7 devices without the user being any the wiser, also exists. The problem...

WiFiles HD 1.3 iOS - Local File Inclusion

Document Title: =============== WiFiles HD v1.3 iOS - File Include Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1214 Release Date: ============= 2014-02-22 Vulnerability Laboratory ID VL-ID: ==================================== 1214...

"Security vulnerability"without a password will be able to turn off"find my iPhone"-vulnerability warning-the black bar safety net

The current iOS 7.0.4 system found a major Bug, no need password to turn off iCloud in the“find my iPhone ”function, and delete the existing account. ! Just a few simple steps it is possible to reproduce this Bug, MacRumors attempts can be found in the 7.0.4 system of the iPhone and iPad to...

Test your Mobile Hacking and Penetration testing Skills with Damn vulnerable iOS app

Smartphones are powerful and popular, with more than thousands of new mobile apps hitting the market everyday. Apps and mobile devices often rely on consumers' data, including private information, photos, and location, that can be vulnerable to data breaches, surveillance and real-world thieves...

iOS 7 Untethered Jailbreak released for iPhone, iPad, and iPod devices

None...

Byword 2.x File Overwrite

Affected Vendor: http://metaclassy.com/ - Affected Software: Byword for iOS - Affected Version: 2.x prior to 2.1 - Issue Type: Lack of validation/user confirmation leading to destruction of data - Release Date: 29 Sept 2013 - Discovered by: Guillaume Ross - CVE Identifier: CVE-2013-5725 - Issue...

iOS 7 Lockscreen Bypass Discovered

Another iOS, another iPhone lockscreen bypass flaw. Hackers have had a only few days to play around with Apple’s latest mobile operating system, iOS 7, but apparently that’s all the time one of them needed to find a flaw that can allow anyone to bypass the lockscreen on phones running the...

Lua-Programming Language 1.6 File Upload

TITLE: Unauthenticated Remote File Upload via HTTP for lua-Programming language 1.6 on iOS Date: 8/1/2013 Author: Larry W. Cashdollar, @larry0 Download: https://itunes.apple.com/us/app/lua-programming-language/id505972017?mt=8&ls=1 http://www.tayutec.com/indexen.html Description: "Please download...