CVE-2025-41459: Improper Authentication

Insufficient protection against brute-force and runtime manipulation in the local authentication component in Two App Studio Journey 5.5.6 on iOS allows local attackers to bypass biometric and PIN-based access control via repeated PIN attempts or dynamic code injection...

CVE-2025-41458: Cleartext Storage of Sensitive Information

Unencrypted storage in the database in Two App Studio Journey v5.5.9 for iOS allows local attackers to extract sensitive data via direct access to the app’s filesystem...

CVE-2025-45156

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

CVE-2025-45156

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users...

CVE-2025-45156

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users...

CVE-2025-45156

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users...

CVE-2025-45156

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

CVE-2025-45157: Improper Access Control

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

CVE-2025-45156: Undefined Security Weakness

Splashin iOS v2.0 fails to enforce server-side interval restrictions for location updates for free-tier users...

PT-2025-30064

Name of the Vulnerable Software and Affected Versions Splashin iOS version 2.0 Description Insecure permissions allow unauthorized attackers to access location data for specific users. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

PT-2025-30063

Name of the Vulnerable Software and Affected Versions Splashin iOS version 2.0 Description The Splashin iOS application version 2.0 does not enforce server-side interval restrictions for location updates for free-tier users. Recommendations Update to a newer version that contains a fix for this...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

CVE-2025-45157

Insecure permissions in Splashin iOS v2.0 allow unauthorized attackers to access location data for specific users...

CVE-2025-45156

The Splashin iOS application version v2.0 is vulnerable to a security flaw where it fails to enforce server-side interval restrictions for location updates specifically for free-tier users . This oversight could potentially lead to location data disclosure . Remediation involves updating the appl...

Security Vulnerabilities in ICEBlock

The ICEBlock tool has vulnerabilities: The developer of ICEBlock, an iOS app for anonymously reporting sightings of US Immigration and Customs Enforcement ICE officials, promises that it "ensures user privacy by storing no personal data." But that claim has come under scrutiny. ICEBlock creator...

CVE-2025-49463

Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access...

Vulnerabilities fixed in Zoom Clients

Zoom has fixed vulnerabilities in Zoom Clients Specifically versions for Linux, Windows, iOS and macOS. The vulnerabilities include incorrect certificate validation in Zoom Workplace for Linux, a buffer overflow in specific Zoom Clients for Windows, cross-site scripting in Zoom Clients for Window...