CVE-2017-13910

An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files...

CVE-2017-13892

An issue existed in the handling of Contact sharing. This issue was addressed with improved handling of user information. This issue is fixed in macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan. Sharing contact information may lead to unexpected...

CVE-2017-13910

An access issue was addressed with additional sandbox restrictions on applications. This issue is fixed in macOS High Sierra 10.13. An application may be able to access restricted files...

Race condition

A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be able to gain elevated privileges...

CVE-2017-13908

CVE-2017-13908 describes a permissions-validation issue in macOS where a local attacker could exploit SMB file permission handling to cause execution of non-executable text files. The root cause is insufficient validation during file permission handling, which could allow leveraging an SMB share ...

CVE-2017-13910

CVE-2017-13910 concerns macOS High Sierra 10.13. Apple fixed an access issue where an application may have been able to access restricted files by adding sandbox restrictions on applications. Affected product: macOS High Sierra; issue is described as an access control/sandboxing problem, mitigate...

CVE-2017-13909

CVE-2017-13909 affects macOS High Sierra 10.13 where sensitive tokens (iCloud authentication tokens) were stored insecurely. Root cause: tokens were stored outside of a secure store; fix implemented by storing tokens in Keychain. Impact: a local attacker may gain access to iCloud authentication t...

CVE-2017-13907

A state management issue was addressed with improved state validation. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan. The screen lock may unexpectedly remain unlocked...

CVE-2017-13906

CVE-2017-13906 is a memory-corruption issue in macOS components that could allow a malicious application to elevate privileges. The vulnerability is fixed in macOS High Sierra 10.13.1 and in Security Update 2017-001 Sierra and Security Update 2017-004 El Capitan (macOS High Sierra 10.13).

CVE-2017-13907

CVE-2017-13907 is a macOS vulnerability described as a state management issue where improved state validation fixes a problem that could cause the screen lock to remain unintentionally unlocked. According to the NVD entry, the fix is included in macOS High Sierra 10.13.1 and Security Updates 2017...

CVE-2017-13892

CVE-2017-13892 affects macOS High Sierra via improper handling of Contact sharing. The issue could lead to unexpected data sharing of contact information. Apple lists fixes in macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, addressing the vulne...

CVE-2017-13835

CVE-2017-13835 describes a memory corruption issue in macOS High Sierra (10.13) that is fixed in that release. The flaw is stated to allow an application to execute arbitrary code with elevated privileges. The available documents do not provide further technical specifics (e.g., vulnerable compon...

CVE-2017-13905

CVE-2017-13905 is a race-condition vulnerability in Apple platforms that could allow an application to gain elevated privileges. The issue was mitigated by Apple through input/validation hardening and fixes across multiple OS updates: tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Updat...

CVE-2017-13880

The CVE-2017-13880 entry describes a memory corruption vulnerability in Apple iOS/watchOS components, fixed in iOS 11.2 and watchOS 4.2. Affected: kernel-space context (kernel privilege). Root cause: memory handling issues leading to memory corruption. Impact: an attacker may be able to execute a...

CVE-2017-13905

A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be able to gain elevated privileges...

CVE-2017-2375

CVE-2017-2375 concerns an issue in preventing the uploading of CallKit call history to iCloud on Apple iOS. The documented root cause is an internal logic issue, and the impact is that updates for CallKit call history were exposed to iCloud. The vulnerability is addressed in iOS 10.2.1, with the ...

CVE-2017-2488

CVE-2017-2488 concerns Apple Remote Desktop; a cryptographic weakness in the authentication protocol allowed an attacker to capture cleartext passwords. The issue was mitigated by implementing the Secure Remote Password authentication protocol and is fixed in Apple Remote Desktop 3.9. Remediation...

VulnCheck KEV: CVE-2017-9554

An information exposure vulnerability in forgetpasswd.cgi in Synology DiskStation Manager DSM before 6.1.3-15152 allows remote attackers to enumerate valid usernames via unspecified vectors...

Deserialization of untrusted data

An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage this vulnerability when the encryption keys are known due...

CVE-2021-44029

CVE-2021-44029 affects Quest KACE Desktop Authority prior to 11.2. The issue allows remote code execution via deserialization in the RadAsyncUpload function of ASP.NET AJAX; exploitation is possible when encryption keys are known (related to CVE-2017-11317/11357 or other means). In newer ASP.NET ...