793 matches found
CVE-2021-32755 Certificate pinning is not enforced on the web socket connection
Wire is a collaboration platform. wire-ios-transport handles authentication of requests, network failures, and retries for the iOS implementation of Wire. In the 3.82 version of the iOS application, a new web socket implementation was introduced for users running iOS 13 or higher. This new...
CVE-2021-32755
CVE-2021-32755 affects Wire’s iOS transport (wire-ios-transport) introduced in the 3.82 iOS app update for iOS 13+, where the new WebSocket implementation does not enforce certificate pinning. The issue is that certificate pinning is enforced starting with version 3.84, meaning versions prior to ...
CVE-2021-0472
In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
CVE-2021-0472
In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
CVE-2021-0472
CVE-2021-0472 concerns a local elevation-of-privilege in Android 9–11 due to a permissions bypass in shouldLockKeyguard (LockTaskController.java) that could allow exiting App Pinning without a PIN and without user interaction. The issue is limited to the Framework component and is described as en...
curl: CVE-2021-22924: Bad connection reuse due to flawed path name checks
Summary: Curlsslconfigmatches attempts to compare whether two SSL connections have identical SSL security options or not. The idea is to avoid reusing a connection that uses less secure, or completely different security options such as capath, cainfo or certificate/issuer pinning. Unfortunately...
ASB-A-176801033
In shouldLockKeyguard of LockTaskController.java, there is a possible way to exit App Pinning without a PIN due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2020-0025
In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
CVE-2020-0025
In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
Design/Logic Flaw
In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
CVE-2020-0025
CVE-2020-0025 affects Android 11, involving a vulnerability in PackageManagerService.deletePackageVersionedInternal that can bypass permissions to exit Screen Pinning. The issue enables local privilege escalation without extra execution privileges and does not require user interaction. NVD and An...
CVE-2020-0025
In deletePackageVersionedInternal of PackageManagerService.java, there is a possible way to exit Screen Pinning due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
HaXmas Hardware Hacking
Usually, when you read an IoT hacking report or blog post, it ends with something along the lines of, "and that's how I got root," or "and there was a secret backdoor credential," or "and every device in the field uses the same S3 bucket with no authentication." You know, something bad, and the...
Workspace App 1912.1000 - Workspace App Update removes user created shortcuts from Desktop
Consider the following scenario: Users have created shortcuts of published applications manually on their Desktop and have also pinned it to the task bar. When the Receiver is upgraded from 4.9.6001 to Workspace App for Windows 1912 or 2006, on the first launch of a published app, the shortcuts...
Rocket.Chat: Pinning leaks message content
The message content could be improperly pinned, allowing the content to be leaked to an unauthorized client. Validation was lacking in the pinMessage method, which allowed arbitrary messages to be pinned regardless of the user's access. This permitted messages from private channels to be exposed ...
MEDUZA - A More Or Less Universal SSL Unpinning Tool For iOS
"MEDUZA" "медуза" means "jellyfish" in Ukrainian What is MEDUZA? It's a Frida-based tool, my replacement for SSLKillSwitch. I created it for in-house use, but then decided to opensource it. TBH, I hate open source, but the world is full of compromises... : How does it work? It's simple. First tim...
UBUNTU-CVE-2020-24661
GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates e.g., self-signed certificates when the client system is not configured to use a system-provided PKCS11 store. This allows a meddler in the middle to present a...
CVE-2019-20883
An issue was discovered in Mattermost Server before 5.8.0, when Town Square is set to Read-Only. Users can pin or unpin a post...