CVE-2015-8025

driver/subprocs.c in XScreenSaver before 5.34 does not properly perform an internal consistency check, which allows physically proximate attackers to bypass the lock screen by hot swapping monitors...

CVE-2015-5923

Apple iOS before 9.0.2 does not properly restrict the options available on the lock screen, which allows physically proximate attackers to read contact data or view photos via unspecified vectors...

Design/Logic Flaw

The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physically proximate attackers to obtain access by visiting an unattended workstation...

Design/Logic Flaw

packages/Keyguard/res/layout/keyguardpasswordview.xml in Lockscreen in Android 5.x before 5.1.1 LMY48M does not restrict the number of characters in the passwordEntry input field, which allows physically proximate attackers to bypass intended access restrictions via a long password that triggers ...

Design/Logic Flaw

Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state...

CVE-2015-5832

The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, which might allow physically proximate attackers to obtain sensitive information via unspecified vectors...

CVE-2015-5850

AppleKeyStore in iOS before 9 is vulnerable: local attackers who have physical access can reset the count of failed passcode attempts via a device backup, effectively weakening the passcode protection. The underlying issue is in the passcode failure logic when handling backups, enabling a restora...

CVE-2015-1319

The CVE-2015-1319 issue affects the Unity Settings Daemon in Ubuntu 14.04 LTS and 15.04. It arises because the daemon does not reliably detect when the screen is locked, allowing a physically proximate attacker to mount removable media (e.g., a USB thumb drive) while the session is locked. Affect...

Black Hat BLEKey RFID Access Control Hack

LAS VEGAS – A device the size of a quarter that can be installed in 60 seconds on a proximity card reader could potentially be used to break physical access controls in 80 percent of deployments. The device, dubbed BLEKey, is used to read cleartext data sent from card readers to door controllers ...

CVE-2015-2019

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive...

Design/Logic Flaw

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive...

CVE-2015-1314

The USAA Mobile Banking application before 7.10.1 for Android displays the most recently-used screen before prompting the user for login, which might allow physically proximate users to obtain banking account numbers and balances...

Design/Logic Flaw

GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button...

CVE-2014-1949

GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button...

CVE-2014-1949

GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button...

CVE-2014-7300

GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging...

openSUSE Security Update : the Linux Kernel (openSUSE-SU-2014:1669-1)

The openSUSE 12.3 kernel was updated to fix security issues : This will be the final kernel update for openSUSE 13.2 during its lifetime, which ends January 4th 2015. CVE-2014-9322: A local privilege escalation in the x8664 32bit compatibility signal handling was fixed, which could be used by loc...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel Security (ELSA-2014-3084)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-3084 advisory. - USB: whiteheat: Added bounds checking for bulk command response James Forshaw Orabug: 19849334 CVE-2014-3185 - HID: fix a couple of off-by-ones...

Information disclosure

House Arrest in Apple iOS before 8.1 relies on the hardware UID for its encryption key, which makes it easier for physically proximate attackers to obtain sensitive information from a Documents directory by obtaining this UID...

Mandriva Linux Security Advisory : kernel (MDVSA-2014:201)

Multiple vulnerabilities has been found and corrected in the Linux kernel : The trytounmapcluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service system crash by triggering a...