Code injection

Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen...

Design/Logic Flaw

The Home & Lock Screen subsystem in Apple iOS before 8 does not properly restrict the private API for app prominence, which allows attackers to determine the frontmost app by leveraging access to a crafted background app...

Design/Logic Flaw

The Accessibility subsystem in Apple iOS before 8 allows attackers to interfere with screen locking via vectors related to AssistiveTouch events...

CVE-2014-4356

Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen...

CVE-2014-4361

The Home & Lock Screen subsystem in Apple iOS before 8 does not properly restrict the private API for app prominence, which allows attackers to determine the frontmost app by leveraging access to a crafted background app...

CVE-2014-4368

The Accessibility subsystem in Apple iOS before 8 allows attackers to interfere with screen locking via vectors related to AssistiveTouch events...

CVE-2014-4361

CVE-2014-4361 affects the Home & Lock Screen subsystem in Apple iOS before 8, where the private API used to determine the frontmost app lacked sufficient access control. Exploitation would allow a crafted background app to reveal which app is frontmost. The issue is described as a lack of proper ...

CVE-2014-4368

The CVE-2014-4368 entry concerns Apple iOS prior to version 8, where a logic issue in the Accessibility subsystem affecting AssistiveTouch event handling could interfere with screen locking. In practical terms, this means that under certain AssistiveTouch-related sequences, the device may fail to...

PT-2014-5831

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8 Description The issue concerns the Home & Lock Screen subsystem, which does not properly restrict access to a private API for app prominence. This allows attackers to determine the frontmost app by leveraging acce...

PT-2014-5829

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8 Description The issue allows physically proximate attackers to obtain sensitive information by reading the lock screen, due to not following the intended configuration setting for text-message preview...

PT-2014-5837

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 8 Description The issue concerns the Accessibility subsystem, where attackers can interfere with screen locking through vectors related to AssistiveTouch events. Recommendations For versions prior to 8, update to...

CVE-2014-4356: Exposure of Sensitive Information to an Unauthorized Actor

Apple iOS before 8 does not follow the intended configuration setting for text-message preview on the lock screen, which allows physically proximate attackers to obtain sensitive information by reading this screen...

CVE-2014-4361: Exposure of Sensitive Information to an Unauthorized Actor

The Home & Lock Screen subsystem in Apple iOS before 8 does not properly restrict the private API for app prominence, which allows attackers to determine the frontmost app by leveraging access to a crafted background app...

CVE-2014-4368: Undefined Security Weakness

The Accessibility subsystem in Apple iOS before 8 allows attackers to interfere with screen locking via vectors related to AssistiveTouch events...

Cyber Espionage Group Ported Windows Malware to Mac

Till now we have seen a series of different malware targeting Windows operating system and not Mac, thanks to Apple in way it safeguard its devices’ security. But with time, cyber criminals and malware authors have found ways to exploit Mac as well. GROUP BEHIND THE MAC VERSION OF BACKDOOR...

Internet Bug Bounty: open redirect in rfc6749

OAuth Providers servers that strictly follow rfc6749 are vulnerable to open redirect. Let me explain, reading 0 If the request fails due to a missing, invalid, or mismatching redirection URI, or if the client identifier is missing or invalid, the authorization server SHOULD inform the resource...

CVE-2012-4234

Cross-site scripting XSS vulnerability in the group moderation screen in the control center control.php in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter...

CVE-2012-4234: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the group moderation screen in the control center control.php in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter...

Apple iOS v7.1.2 iPhone - Merge App Bypass Vulnerability

Document Title: =============== Apple iOS v7.1.2 iPhone - Merge App Bypass Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1281 Video: https://www.youtube.com/watch?v=9gBtJ5tyRgI Advisory: http://www.vulnerability-lab.com/getcontent.php?id=1280 Vulnerabili...

Apple iOS v7.1.2 - (Merge Apps) Bypass Vulnerability

Document Title: =============== Apple iOS v7.1.2 - Merge Apps Bypass Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1280 Video: http://www.vulnerability-lab.com/getcontent.php?id=1281 Vulnerability Magazine:...