59555 matches found
CVE-2025-43408
This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An attacker with physical access may be able to access contacts from the lock screen...
CVE-2025-43408
This CVE affects macOS Sonoma 14.8.2, macOS Sequoia 15.7.2, and macOS Tahoe 26.1. Root cause: an under‑restricted lock device option allowed a physically present attacker to access contacts from the lock screen. The issue is fixed in the listed updates. Remediation: upgrade to macOS Sonoma 14.8.2...
CVE-2025-43408
This issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. An attacker with physical access may be able to access contacts from the lock screen...
PT-2025-44849
Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.2 macOS versions prior to Sequoia 15.7.2 Description An attacker with physical access may be able to access contacts from the lock screen. The issue was addressed by restricting options offered on a locked...
Apple macOS 安全漏洞
Apple macOS is a suite of specialized operating systems from the U.S.-based Apple Inc. developed specifically for Mac computers. A security vulnerability exists in Apple macOS Sonoma prior to 14.8.2 and Sequoia prior to 15.7.2, which stems from an under-restricted lock device option that could...
Insecure Direct Object Reference (IDOR)
Liferay Portal including Liferay DXP is vulnerable to an Insecure Direct Object Reference IDOR. The vulnerability is due to the Contacts Center widget directly exposing the comliferaycontactswebportletContactsCenterPortletentryId parameter without proper authorization checks. An attackers can use...
PT-2025-43475
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Malicious code in npmrunnode-fetch-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74027deb8f96cb586a9b82484dbb7818ccfbbfdd2147a05fdae660aad4211e53 The OpenSSF Package Analysis project identified 'npmrunnode-fetch-test' @ 1337.1.0 npm as malicious. It is considered malicious because: - The...
Nextcloud: BOLA/IDOR in Out-of-Office API allows any authenticated user to read other users' absence data
Summary The Out-of-Office OOO API endpoints at /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId and /ocs/v2.php/apps/dav/api/v1/outOfOffice/userId/now suffer from a Broken Object Level Authorization BOLA vulnerability. Any authenticated user can retrieve the out-of-office data of any other user by...
CVE-2025-21050
Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...
CVE-2025-21050
Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...
CVE-2025-21050
Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...
EUVD-2025-33662
Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...
CVE-2025-21050
Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...
CVE-2025-21050
Improper input validiation in Contacts prior to SMR Oct-2025 Release 1 allows local attackers to access data across multiple user profiles...
CVE-2025-21050
CVE-2025-21050 affects Samsung Mobile devices in the Contacts component prior to SMR Oct-2025 Release 1. The root cause is improper input validation, enabling a local attacker to access data across multiple user profiles. Impact is confidentiality-focused (high), with local, low-complexity access...
PT-2025-41511
Name of the Vulnerable Software and Affected Versions Contacts versions prior to SMR Oct-2025 Release 1 Description An improper input validation issue exists in Contacts prior to the SMR Oct-2025 Release 1. This allows local attackers to access data across multiple user profiles. The vulnerabilit...
New ClayRat Spyware Targets Android Users via Fake WhatsApp and TikTok Apps
A rapidly evolving Android spyware campaign called ClayRat has targeted users in Russia using a mix of Telegram channels and lookalike phishing websites by impersonating popular apps like WhatsApp, Google Photos, TikTok, and YouTube as lures to install them. "Once active, the spyware can exfiltra...
Malicious code in v0-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71d07f2261c23ad9fe0c5b269a07b716f10747239391c989fc1979b322b68b67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
HTTP Response Splitting
Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the Content-Disposition header. An attacker can manipulate the file extension of downloaded vCard files by supplying crafted input, potentially leading to user confusion or further exploitation. Remediation...