CVE-2018-13434

MEDIUM Year: 2018
CVSS v3 Score
6.3
Medium
CVSS v2 Score
4.4
Medium
Weakness Type
CWE-287
View all →

Vulnerability Description

An issue was discovered in the LINE jp.naver.line application 8.8.0 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred

Related Vulnerabilities

CVE-2018-1672

MEDIUM
CVSS:6.3(Medium)

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user. IBM X-Forc...

CWE-2872018

CVE-2022-23541

MEDIUM
CVSS:6.3(Medium)

jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `s...

CWE-2872022

CVE-2022-43690

MEDIUM
CVSS:6.3(Medium)

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionali...

CWE-2872022

CVE-2023-41751

MEDIUM
CVSS:6.3(Medium)

Sensitive information disclosure due to improper token expiration validation. The following products are affected: Acronis Agent (Windows) before build 32047.

CWE-2872023

CVE-2023-45866

MEDIUM
CVSS:6.3(Medium)

Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injecti...

CWE-2872023

CVE-2024-22395

MEDIUM
CVSS:6.3(Medium)

Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could potentially enable a remote authenticated attacker to associat...

CWE-2872024