Design/Logic Flaw

Keep-alive vulnerability in the sticky broadcast mechanism. Successful exploitation of this vulnerability may cause malicious apps to run continuously in the background...

Design/Logic Flaw

Permission control vulnerability in the MediaPlaybackController module. Successful exploitation of this vulnerability may affect availability...

Design/Logic Flaw

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may bypass Gatekeeper checks...

Design/Logic Flaw

This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials...

Design/Logic Flaw

Vulnerability of mutex management in the bone voice ID trusted application TA module. Successful exploitation of this vulnerability may cause the bone voice ID feature to be unavailable...

Design/Logic Flaw

Screenshot vulnerability in the input module. Successful exploitation of this vulnerability may affect confidentiality...

Design/Logic Flaw

The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to modify protected parts of the file system...

Design/Logic Flaw

This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14. A shortcut may output sensitive user data without consent...

Design/Logic Flaw

If Windows failed to duplicate a handle during process creation, the sandbox code may have inadvertently freed a pointer twice, resulting in a use-after-free and a potentially exploitable crash. This bug only affects Firefox on Windows when run in non-standard configurations such as using runas...

Design/Logic Flaw

The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. An app may be able to access user-sensitive data...

Design/Logic Flaw

SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method...

Design/Logic Flaw

A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file can lead to a use-after-free. An attacker can trick a user into opening a malformed file to trigger this vulnerability...

Design/Logic Flaw

SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges...

Design/Logic Flaw

The issue was addressed with improved checks. This issue is fixed in iOS 17 and iPadOS 17, watchOS 10, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. An app may be able to identify what other apps a user has installed...

Design/Logic Flaw

xunruicms up to v4.5.1 was discovered to contain a remote code execution RCE vulnerability in /index.php. This vulnerability allows attackers to execute arbitrary code via a crafted GET request...

The vulnerability of Cobalt Ashlar-Vellum’s software for parametric automated design and 3D modeling lies in its inability to handle resources of incompatible types. This allows a hacker to execute arbitrary code.

The vulnerability of Cobalt Ashlar-Vellum’s parametric automated design and 3D modeling software lies in its inability to access resources through incompatible types. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially crafted AR format files...

The vulnerability of software for modeling, designing, and drawing in AutoCAD arises from copying buffers without checking the size of the input data. This allows a perpetrator to execute arbitrary code.

The vulnerability of software for modeling, designing, and drawing in AutoCAD is related to the copying of buffers without checking the size of input data when processing SLDASM files. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of Cobalt Ashlar-Vellum’s software for parametric automated design and 3D modeling lies in its reliance on memory after it is released. This allows a hacker to execute arbitrary code.

The vulnerability of Cobalt Ashlar-Vellum’s parametric automated design and 3D modeling software lies in the use of memory after it is freed. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially crafted AR format files...

Design/Logic Flaw

Docker Desktop 4.11.x allows --no-windows-containers flag bypass via IPC response spoofing which may lead to Local Privilege Escalation LPE.This issue affects Docker Desktop: 4.11.X...

Design/Logic Flaw

Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation ECI restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for Docker Business customers only and...