Yes, we did it again!

Due to the last few years we have discovered several problems that bypass the password protection mechanism of ios. In recent weeks we have discovered a new problem affecting the latest ios versions 12.1 and 12.1.1.1.

The vulnerability allows password protection to be bypassed with the pin to allow unauthorized access to sensitive data such as contacts, image libraries and other standard setup applications. The problem affects all Apple iPhone and iPad devices with the ability to call (sim).

The access permission vulnerability is located in the Message menu to answer custom messages in combination with the standard app features available on the ios device. The problem allows you to combine different methods used to access and edit photos in restricted mode.

Open Redirect in Microsoft BingPlaces Business uncovered

Security researchers of the vulnerability laboratory uncovered this week an open redirect vulnerability in the famous microsoft bingplaces business web-application. The issue allows to redirect users by client-side get method request to external malformed or malicious sources.

The open redirect security vulnerability is located in the `url` parameter of the `TrackEmailOpen` function in the `StatsTracker` module. The `url` parameter has no restriction to the requested url content. Remote attackers are able to redirect client-side get method requests because of a non restricted url parameter. The attack vector of the vulnerability is non-persistent and the request method to execute is get. The vulnerability is a classic open redirect web vulnerability.

Vulnerable Module(s):
[+] StatsTracker