If you are a security-aware person, you probably use one of the secure messengers. 😏 And maybe to improve your comfort, you installed its desktop version on your mac? Sometimes we leave our computer unattended when we go to make a coffee, or we need to talk with somebody in the other room. Since we are security-aware, we always lock our screens (you do that, right?). But what if all messages sent to you will be visible on your locked mac?

During my work, I was auditing a Cordova App and then I saw a plain text password right in the logs. I talked to the developer and it proved that Cordova doesn’t support Keychain by itself. One of the most popular Keychain plugins (also used by this developer) is https://github.com/ionic-team/cordova-plugin-ios-keychain. Turned out there was a forgotten NSLog call that logged all keychain entries: I have reported it and the bug is now fixed (CVE-2018-1000123).

What FreePlane is? FreePlane is an open-source application intended for creating mind maps. Vulnerability descripton: FreePlane is a Java-based app that loads its mind maps that are stored as simple XML files. The parser allowed to expand external entities that caused this vulnerability. Results: When the victim opens a maliciously crafted mind map, any accessible by Java file can be sent to the attacker. Proof of concept: Malicious mindmap: <map version="freeplane 1.