Touch Bank - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Touch Bank published at the 'play' market has multiple vulnerabilities...

CVE-2016-7601

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Local Authentication" component, which does not honor the configured screen-lock time interval if the Touch ID prompt is visible...

Authentication flaw

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Local Authentication" component, which does not honor the configured screen-lock time interval if the Touch ID prompt is visible...

CVE-2016-7601

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Local Authentication" component, which does not honor the configured screen-lock time interval if the Touch ID prompt is visible...

CVE-2016-7601

Affected product: iOS before 10.2; Local Authentication logic issue where the idle timer is not honored when the Touch ID prompt is visible. Root cause: idle-timer handling when Touch ID prompt appears, allowing prolonged unlocked state. Impact: a nearby or local user could potentially access thr...

CVE-2016-7601: Undefined Security Weakness

An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Local Authentication" component, which does not honor the configured screen-lock time interval if the Touch ID prompt is visible...

Events and disabled form fields

I've been working on the web since I was a small child all the way through to the haggard old man I am to day. However, the web still continues to surprise me. Turns out, mouse events don't fire when the pointer is over disabled form elements, except in Firefox. Serious? Serious. Give it a go. Mo...

CVE-2017-5634

The Norwegian Air Shuttle aka norwegian.com airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to...

Design/Logic Flaw

The Norwegian Air Shuttle aka norwegian.com airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to...

CVE-2017-5634

The Norwegian Air Shuttle aka norwegian.com airline kiosk allows physically proximate attackers to bypass the intended "Please select booking identification" UI step, and obtain administrative privileges and network access on the underlying Windows OS, by accessing a touch-screen print icon to...

Systemd 228 Privilege Escalation

This is a heads up for a trivial systemd local root exploit, that was silently fixed in the upstream git as: commit 06eeacb6fe029804f296b065b3ce91e796e1cd0e Author: .... Date: Fri Jan 29 23:36:08 2016 +0200 basic: fix touch creating files with 07777 mode modet is unsigned, so MODEINVALID 0 can...

Apple macOS 10.12.1 iOS 10.2 - Kernel Userspace Pointer Memory Corruption

Apple macOS 10.12.1 iOS 10.2 - Kernel Userspace Pointer Memory Corruption Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1004 machvoucherextractattrrecipetrap is a mach trap which can be called from any context Here's the code: kernreturnt machvoucherextractattrrecipetrapstruct...

CVE-2016-10147

crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service NULL pointer dereference and system crash by using an AFALG socket with an incompatible algorithm, as demonstrated by mcryptdmd5...

MS16-148: Description of the security update for Excel 2013: December 13, 2016

MS16-148: Description of the security update for Excel 2013: December 13, 2016 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

Huawei Play 5C phone TP touchscreen driver suffers from buffer overflow vulnerability

Huawei Play 5C is a smartphone from Huawei. A buffer overflow vulnerability exists in the TP touchscreen driver of the Huawei Play 5C phone. Due to the lack of parameter checking in the TP touchscreen driver, an attacker who gains root privileges and exploits the vulnerability can construct...

To bypass the password to access the iPhone photo or message even iOS 1 0 also affected-vulnerability warning-the black bar safety net

Set the iPhone screen lock password to prevent others from accessing your personal data the preferred method, but the lock screen password is also your phone security the first line of Defense, which is for Android also. But you know what? The last few major version of the iOS lock screen to...

CVE-2016-7917

The nfnetlinkrcvbatch function in net/netfilter/nfnetlink.c in the Linux kernel before 4.5 does not check whether a batch message's length field is large enough, which allows local users to obtain sensitive information from kernel memory or cause a denial of service infinite loop or out-of-bounds...

GNU GTypist 2.9.5-2 Buffer Overflow

Exploit developed using Exploit Pack v6.5 Exploit Author: Juan Sacco - http://www.exploitpack.com - [email protected] Program affected: GNU Typist Affected value: ARG0 Version: 2.9.5-2 Tested and developed under: Kali Linux 2.0 x86 - https://www.kali.org Program description: Simple ncurses...

Hacking Firmware from Mobile Phone Hacking Company Leaked Online

The Israeli firm Cellebrite, which provides digital forensics tools and software to help law enforcement access mobile phones in investigations, has had its firmware and software leaked online. Yes, you heard that right. Cellebrite's most sensitive in-house capabilities have been made public by o...

CVE-2016-7042

The prockeysshow function in security/keys/proc.c in the Linux kernel through 4.8.2, when the GNU Compiler Collection gcc stack protector is enabled, uses an incorrect buffer size for certain timeout data, which allows local users to cause a denial of service stack memory corruption and panic by...