195 matches found
DVIA-v2
DVIA-v2 제공: 8ksec.io Swift로 작성된 DVIA-v2 및 추가 취약점 Damn Vulnerable iOS App DVIA는 몹시 취약한 iOS 애플리케이션입니다. 이 앱의 주요 목표는 모바일 보안 애호가/전문가 또는 학생들이 합법적인 환경에서 iOS 침투 테스트 기술을 테스트할 수 있는 플랫폼을 제공하는 것입니다. 이 프로젝트는 @prateekg147이가 개발 및 유지 관리합니다. 이 앱에서 다루는 취약점과 솔루션은 iOS 11까지 테스트되었습니다. 현재 버전은 Swift로 작성되었으며 다음과 같은 취약점이...
ipa-scope
IPA-SCOPE v.2 IPA-SCOPE는 iOS 애플리케이션을 대상으로 하는 정적 분석 도구로, 링크, 흥미로운 파일 .json, .cer, .der, .api 과 같은 중요한 정보를 제공하며, iOS 앱 침투 테스트 시 좋은 결과를 보여주는 데 매우 유용합니다. 이 도구의 새로운 점 ✅ 빠르고 사용하기 쉬움 ✅ 바이너리 정보API 키, 서브도메인 등 가져오기 ✅ 필터 결과 저장 및 표시 ✅ 대상 앱의 연결된 라이브러리 가져오기 ✅ 앱의 모든 문자열 및 클래스 가져오기 요구 사항 : linux 또는 Mac OS 설치 : g...
evilnotify
EvilNotify CVE-2025-24091을 활용하는 아주 간단한 iOS 앱입니다. 딱히 유용한 건 아니고, 그냥 재미삼아 만든 것입니다. 설치 1. Releases 탭에서 최신 .ipa 파일을 받으세요. 2. LiveContainer 또는 기타 사이드로딩 서비스를 통해 설치하세요. 사용법 사용자 지정 키를 추가하거나 사전 설정된 키를 사용하세요. !NOTE 멋진 키를 발견하면 Discord로 보내주세요. 사전 설정 목록에 추가할 수 있는지 확인해 보겠습니다! 크레딧 insidegui — CVE-2025-24091...
CVE-2026-101047
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests enterprise tier only with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet...
CVE-2026-101047: Missing Authorization
Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests enterprise tier only with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet...
PT-2026-53283
Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2025.5.0 Description The iOS companion app fails to respect the SSID allowlist for internal networks. While the app typically uses the Service Set Identifier SSID—the public name of a wireless network—to...
CVE-2019-25339 GHIA CamIP 1.2 for iOS - 'Password' Denial of Service
GHIA CamIP 1.2 for iOS contains a denial of service vulnerability in the password input field that allows attackers to crash the application. Attackers can paste a 33-character buffer of repeated characters into the password field to trigger an application crash on iOS devices...
CVE-2025-12699
The ZOLL ePCR IOS application reflects unsanitized user input into a WebView. Attacker-controlled strings placed into PCR fields run number, incident, call sign, notes are interpreted as HTML/JS when the app prints or renders that content. In the proof of concept POC, injected scripts return loca...
CVE-2020-37086
Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths without authentication. Attackers can exploit the vulnerability by manipulating path parameters in GET and POST requests to list or download...
CVE-2022-50952
Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Name Profile input. Attackers can inject malicious script code through a POST request that executes on application review without user interaction...
EUVD-2022-55945
Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Name Profile input. Attackers can inject malicious script code through a POST request that executes on application review without user interaction...
CVE-2022-50952: Improper Neutralization of Input During Web Page Generation
Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Name Profile input. Attackers can inject malicious script code through a POST request that executes on application review without user interaction...
CVE-2020-36995
Mocha Telnet Lite for iOS 4.2 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the user configuration input. Attackers can overwrite the 'User' field with 350 bytes of repeated characters to trigger an application crash and prevent normal...
CVE-2021-41719
Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the...
CVE-2021-33982
An insufficient session expiration vulnerability exists in the "Fish | Hunt FL" iOS app version 3.8.0 and earlier, which allows a remote attacker to reuse, spoof, or steal other user and admin sessions...
CVE-2020-12129
The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function...
EUVD-2014-5131
Malware in sbrugna...