Nextcloud: Blind Stored XSS on iOS App due to Unsanitized Webview

Hi Team! I found a Blind XSS can executed on iOS App due to unsanitized webview. Using this issue, attacker can extract information from victim. Steps To Reproduce: 1. Upload malicious HTML, share to victim 2. Waiting victim to open it F487447 F487448 HTML payload attached, don't forget to change...

WordPress iOS App Bug Leaked Secret Access Tokens to Third-Party Sites

If you have a "private" blog with WordPress.com and are using its official iOS app to create or edit posts and pages, the secret authentication token for your admin account might have accidentally been leaked to third-party websites. WordPress has recently patched a severe vulnerability in its iO...

Directory traversal

Directory traversal vulnerability in 'an' App for iOS Version 3.2.0 and earlier allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2019-5927

The CVE affects the iOS app "an" App for iOS (version 3.2.0 and earlier). The root cause is a directory traversal vulnerability that allows a remote attacker to read arbitrary files via unspecified vectors. The issue is tied to an older component (cordova-plugin-ionic-webview) as described in pub...

"an" App for iOS Directory Traversal Vulnerability

"an" App for iOS is an app. A directory traversal vulnerability exists in "an" App for iOS. A remote attacker can exploit this vulnerability to obtain arbitrary files...

CVE-2019-1689

A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this...

PT-2019-1538 · Cisco · Cisco Webex Teams

Name of the Vulnerable Software and Affected Versions: Cisco Webex Teams versions prior to 3.13.26920 Description: The issue is related to improper input validation in the client application, allowing an authenticated, remote attacker to upload arbitrary files within the scope of the iOS...

CVE-2019-5910

Directory traversal vulnerability in HOUSE GATE App for iOS 1.7.8 and earlier allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2019-5910

The CVE-2019-5910 issue affects HOUSE GATE App for iOS (versions 1.7.8 and earlier). The root cause is the app using an old cordova-plugin-ionic-webview, inheriting a directory traversal weakness (CWE-22, CVE-2018-16202) that can allow a remote attacker to read arbitrary files on the device. Impa...

JVN#98505783: HOUSE GATE App for iOS vulnerable to directory traversal

HOUSE GATE App for iOS provided by HOUSE GATE inc. uses the old version of cordova-plugin-ionic-webview, and inherits a directory traversal vulnerability CWE-22, CVE-2018-16202. Impact A remote attacker may obtain an arbitrary file such as a file related to an application on iOS device. As a...

CVE-2018-18071

An issue was discovered in the Daimler Mercedes-Benz Me app 2.11.0-846 for iOS. The encrypted Connected Vehicle API data exchange between the app and a server might be intercepted. The app can be used to operate the Remote Parking Pilot, unlock the vehicle, or obtain sensitive information such as...

See how I found Yahoo Mail APP stored XSS vulnerability-vulnerability warning-the black bar safety net

! Today I want to share is to participate in Yahoo（Yahoo!） Vulnerability all test items to find the one on Yahoo Mail iOS app vulnerability, and ultimately, by virtue of the vulnerability, I go into the Yahoo security Hall of Fame and get a$3500 dollar reward. Vulnerability case My test object is...

CVE-2018-16132

The image rendering component createGenericPreview of the Open Whisper Signal app through 2.29.0 for iOS fails to check for unreasonably large images before manipulating received images. This allows for a large image sent to a user to exhaust all available memory when the image is displayed,...

CVE-2018-13435

An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The Passcode feature allows authentication bypass via runtime manipulation that forces a certain method to disable passcode authentication. NOTE: the vendor indicates that this is not an attack of interest within the...

CVE-2018-13434

An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric TouchID validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. ...

CVE-2017-13101 Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption

Musical.ly Inc., musical.ly - your video social network, 6.1.6, 2017-10-03, iOS application uses a hard-coded key for encryption. Data stored using this key can be decrypted by anyone able to access this key...

CVE-2017-14709

The komoot GmbH "Komoot - Cycling & Hiking Maps" app before 9.3.2 -- aka komoot-cycling-hiking-maps/id447374873 -- for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

App Launch Fails for iOS: "Engine was not loaded.The remote SSL peer sent a handshake failure alert. Error Number: 183."

App Launch Fails for IOS users- Error: "Engine was not loaded. The remote SSL peer sent a handshake failure alert. Error Number: 183."...

CVE-2018-0611

The ANA App for iOS version 4.0.22 and earlier does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Bitpie application for Android and iOS information disclosure vulnerability

Bitpie application for Android is an Android-based application for managing and trading multiple blockchain assets.Bitpie application for iOS is its iOS-based version. A security vulnerability exists in versions 3.2.4 and earlier of the Bitpie application for Android and iOS based platforms, whic...