CVE-2023-23132

Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys...

CVE-2022-39257 Matrix iOS SDK vulnerable to impersonation via forwarded Megolm sessions

Matrix iOS SDK allows developers to build iOS apps compatible with Matrix. Prior to version 0.23.19, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this m...

CVE-2022-37193

Chipolo ONE Bluetooth tracker 2020 Chipolo iOS app version 4.13.0 is vulnerable to Incorrect Access Control. Chipolo devices suffer from access revocation evasion attacks once the malicious sharee obtains the access credentials...

CVE-2022-29482

'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack...

CVE-2021-41994

The CVE-2021-41994 entry concerns PingID: an RSA misconfiguration in the PingID iOS app prior to 1.19. This flaw enables pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login. Affected component: PingID iOS app (pre-1.19); root cause: RSA misconfigurati...

CVE-2021-45490

The client applications in 3CX on Windows, the 3CX app for iOS, and the 3CX application for Android through 2022-03-17 lack SSL certificate validation...

Rcdevs OpenOtp Ios Mobile Application 安全漏洞

Rcdevs OpenOtp Ios Mobile Application is a mobile authentication solution from Rcdevs Luxembourg. A security vulnerability exists in Rcdevs OpenOtp Ios Mobile Application 1.4.13 and 1.4.14, which can be exploited by an attacker to retrieve the PIN code used to access the application...

JVN#10168753: SNKRDUNK Market Place App for iOS vulnerable to improper server certificate verification

SNKRDUNK Market Place App for iOS provided SODA, Inc. is vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on and/or alter the communication. Solution Update the application Update the application to the latest...

CVE-2021-36215

LINE client for iOS 10.21.3 and before allows address bar spoofing due to inappropriate address handling...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

CVE-2021-33982

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

Session fixation

An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...

Deserialization of untrusted data

An insecure, direct object vulnerability in hunting/fishing license retrieval function of the "Fish | Hunt FL" iOS app versions 3.8.0 and earlier allows a remote authenticated attacker to retrieve other people's personal information and images of their hunting/fishing licenses...

CVE-2021-33981

CVE-2021-33981 affects the Fish | Hunt FL iOS app (versions 3.8.0 and earlier). The issue is an insecure direct object vulnerability in the hunting/fishing license retrieval function, allowing a remote authenticated attacker to access other users’ personal information and license images. Root cau...

The Top 30 Vulnerabilities Include Plenty of Usual Suspects

Plus: A sneaky iOS app, a wiper attack in Iran, and more of the week’s top security news...

Cross site scripting

LINE client for iOS before 10.16.3 allows cross site script with specific header in WebView...

Nextcloud 信息泄露漏洞

Nextcloud is an open source, self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. An information disclosure vulnerability exists in the Nextcloud iOS App that originates from the default Nextcloud Server and iOS Client leaking shared searches to...

CIRA Canadian Shield Security Feature Vulnerability

CIRA Canadian Shield is an application from CIRA Canada Inc. provides protection from online threats such as malicious domains, phishing sites, and helps keep your personal data private. A security feature vulnerability exists in the CIRA Canadian Shield app for iOS versions prior to 4.0.13 that...

CVE-2021-27189

The CIRA Canadian Shield app before 4.0.13 for iOS lacks SSL Certificate Validation...

CVE-2021-27189

CVE-2021-27189 affects the CIRA Canadian Shield iOS app prior to version 4.0.13, which lacks SSL certificate validation. Root cause: improper server certificate validation in the app, enabling potential man-in-the-middle attacks. Impact: an attacker who can perform a MITM could present a bogus ce...