A vulnerability with VLC for iOS allows local attackers to steal the data from the storage by just having the source URL/IP.
The vulnerability was discovered by the security researcher Dhiraj and the flaw resides in the functionality of the application for iOS.
According to the researcher, the “VLC for iOS was vulnerable to an unauthenticated insecure direct object reference“, an attacker can exploit this vulnerability by just changing the “id”, “pid”, “uid” in the URL.
So the website or the application saves the request and it goes to the database and fetches different records than the permitted for the user.
Here the vulnerability resides in the functionality that allows users to share files with others over WiFi.
If two users sharing the video over Wi-Fi using vlc-iOS and the third user by just having the source IP can trigger a successfully unauthenticated IDOR.
It is a free VLC media player to iPad, iPhone, and iPod touch. It is a free open source cross-platform multimedia player and framework that plays most multimedia files.
The bug has been reported to VLC and it was fixed with version Version 3.2.7, which was released on March 25th.
Along with this, they fixed other bugs, here you can get the complete details.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…