Apple Patches Two iOS Zero-Days Abused for Years

Update Researchers are reporting two Apple iOS zero-day security vulnerabilities affecting its Mail app on iPhones and iPads. Impacted are iOS 6 and iOS 13.4.1. Apple patched both vulnerabilities in iOS 13.4.5 beta, released last week. A final release of iOS 13.4.5 is expected soon. Both...

New iPhone Zero-Day Discovered

Last year, ZecOps discovered two iPhone zero-day exploits. They will be patched in the next iOS release: Avraham declined to disclose many details about who the targets were, and did not say whether they lost any data as a result of the attacks, but said "we were a bit surprised about who was...

Zero-Day Warning: It's Possible to Hack iPhones Just by Sending Emails

Watch out Apple users! The default mailing app pre-installed on millions of iPhones and iPads has been found vulnerable to two critical flaws that attackers are exploiting in the wild, at least, from the last two years to spy on high-profile victims. The flaws could eventually let remote hackers...

Zero-Day Warning: It's Possible to Hack iPhones Just by Sending Emails

Watch out Apple users! The default mailing app pre-installed on millions of iPhones and iPads has been found vulnerable to two critical flaws that attackers are exploiting in the wild, at least, from the last two years to spy on high-profile victims. The flaws could eventually let remote hackers...

VulnCheck KEV: CVE-2020-9819

Apple iOS, iPadOS, and watchOS Mail contains a memory corruption vulnerability that may allow heap corruption when processing a maliciously crafted mail message...

The vulnerability of the rendering module in WebKit operating systems for iOS, tvOS, the multimedia player iTunes for Windows, the browser Safari, and the iCloud for Windows service allows a hacker to execute arbitrary code.

The vulnerability of the rendering module in WebKit operating systems for iOS, tvOS, the multimedia player iTunes for Windows, the browser Safari, and the iCloud for Windows service is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability allows a...

The vulnerability of the WebKit rendering module in OpenSUSE Leap operating systems, Mac OS X, iOS, tvOS, watchOS, Safari browser, multimedia player iTunes, and iCloud service is related to buffer overflows in memory. This allows attackers to execute a type of “cross-site scripting” attack.

The vulnerability of the WebKit rendering module in OpenSUSE Leap operating systems, Mac OS X, iOS, tvOS, watchOS, Safari browser, multimedia player iTunes, and iCloud service is related to buffer overflow in memory. Exploiting this vulnerability allows a malicious actor to carry out a “cross-sit...

The vulnerability of the rendering module in WebKit operating systems such as openSUSE Leap, Mac OS X, iOS, tvOS, and the Safari browser lies in the use of memory after it is released. This vulnerability allows an attacker to execute arbitrary code.

The vulnerability of the WebKit rendering module in OpenSUSE Leap operating systems, Mac OS X, iOS, tvOS, Safari browser, multimedia player iTunes, and iCloud service is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary cod...

SuperBackup v2.0.5 iOS - VCF Persistent XSS Vulnerability

Document Title: =============== SuperBackup v2.0.5 iOS - VCF Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2202 Release Date: ============= 2020-04-14 Vulnerability Laboratory ID VL-ID: ====================================...

The vulnerability of the rendering module in WebKit operating systems such as openSUSE Leap, Mac OS X, iOS, tvOS, and the Safari browser lies in the use of memory after it is freed. This vulnerability allows an attacker to execute arbitrary code.

The vulnerability of the WebKit rendering module in OpenSUSE Leap operating systems, Mac OS X, iOS, tvOS, Safari browser, multimedia player iTunes, and iCloud service is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary cod...

Apple App Store Riddled With Money-Sucking Fleeceware Apps

Researchers are warning iPhone users of fleeceware apps after finding more than 30 examples of them on Apple’s App Store. Fleeceware is jargon for apps that trick users into paying excessive fees for basic applications and functionality that is available free elsewhere. Many of these fleeceware...

Exploit for Out-of-bounds Read in Apple Iphone_Os

CVE-2019-6207 $ clang exploit.c -o exploit $ ./exploit...

About the security content of iOS 12.4.3 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

Apple Security Update: iOS 13.4.1 and iPadOS 13.4.1

Apple recommends to install security update iOS 13.4.1 and iPadOS 13.4.1 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...

Apple Security Update: iOS 13.4.1 and iPadOS 13.4.1

Apple recommends to install security update iOS 13.4.1 and iPadOS 13.4.1 on devices iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation...

WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting

Title: WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting Date: 2020-01-21 Exploit Author: Gal Weizman Vendor Homepage: https://www.whatsapp.com Software Link: https://web.whatsapp.com/desktop/windows/release/x64/WhatsAppSetup.exe Software Link:...

WhatsApp Desktop 0.3.9308 Cross Site Scripting

Title: WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting Date: 2020-01-21 Exploit Author: Gal Weizman Vendor Homepage: https://www.whatsapp.com Software Link: https://web.whatsapp.com/desktop/windows/release/x64/WhatsAppSetup.exe Software Link:...

Bugs allowed hackers to hijack & activate Mac, iPhone cameras

By Deeba Ahmed There are two main types of hackers, Black Hat Hackers are the bad guys who perform hacking with malicious objectives, and White Hat Hackers are the good guys. This is a post from HackRead.com Read the original post: Bugs allowed hackers to hijack & activate Mac, iPhone cameras...

CVE-2020-6812

The Mozilla Foundation Security Advisory describes this flaw as: The first time AirPods are connected to an iPhone, they become named after the user's name by default e.g. Jane Doe's AirPods. Websites with camera or microphone permission are able to enumerate device names, disclosing the user's...

Hackers Used Local News Sites to Install Spyware On iPhones

A newly discovered watering-hole campaign is targeting Apple iPhone users in Hong Kong by using malicious website links as a lure to install spyware on the devices. According to research published by Trend Micro and Kaspersky, the "Operation Poisoned News" attack leverages a remote iOS exploit...