appledb_rs

Appleアーティファクトデータベース プラットフォーム/バージョンごとにApple内部に関するさまざまな情報を保存するサーバーです。 保存されるアーティファクト: 実行可能ファイル エンタイトルメント フレームワーク デバイス バージョン 主な特徴: APIコール、CLI、WebUIによる完全なアクセス 拡張が容易な設計 完全オフライン環境でも動作します！ インストール 改善されたドキュメントはこちらにあります。 サーバー設定 改善されたドキュメントはこちらにあります。 APIドキュメント Swaggerドキュメントは、サーバー実行時に公開ルートと管理ルートの両方で利用できます:...

ios-mac-app

Proton VPN for iOS and macOS Copyright c 2025 Proton Technologies AG 依存関係 このプロジェクトは、すべての依存関係に Swift Package Manager を使用しています。ターゲットを実行する前に、Xcode でパッケージを解決できるようにしてください。 サードパーティの依存関係 ACKNOWLEDGEMENTS.md セットアップ お使いのマシンで Git LFS を有効にしてください このリポジトリをクローンしてください サブモジュールもクローンしてください git submodule init + git...

CVE-2020-9934

CVE-2020-9934 이 개념 증명PoC은 간단한 Swift 프로그램으로, 자기 자신과 터미널에 모든 kTCCService 권한tccd에서 가져옴을 부여한 후 다음 네 가지 작업을 수행합니다: TCC 보호 디렉토리에 라는 이름의 파일 생성 TCC 보호 디렉토리 내에서 해당 파일의 데이터 읽기 TCC 디렉토리의 모든 파일 목록 표시 포함 TCC 보호 디렉토리에서 파일 제거 사용법: ./bypasstc 전체 글은 Medium에서 확인하세요...

DylibHijackTest

DylibHijackTest 必要条件 Python3の要件をインストール: pip3 install -r requirements.txt GitHubからコンパイル済みのものを信頼しないため、ソースからdylibをコンパイル: gcc -dynamiclib DylibHijackTest.c -o DylibHijackTest.dylib 仕組み ⚠️ これによりマシン上で多くのプロセスが起動されます。VMで実行してください : ここでは細心の注意を払ってください! inject.py フォルダを再帰的にクロールし、MHEXECUTEヘッダーを持つMach-Oバイナリを検索する...

CVE-2026-75030: Missing Authorization

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass deprovision group members, regardless of their group-related administration capabilities. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-62183

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

CVE-2026-63071

Apache Syncope is vulnerable to an Improper Isolation or Compartmentalization flaw due to a bypass in the Groovy security sandbox (specifically the GroovySandboxScriptEngineImpl in the core/spring module). An administrator with entitlements to manage Implementations can create a malicious Groovy ...

CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

PT-2026-61610

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description Improper isolation or compartmentalization allows an administrator with entitlements for...

CVE-2026-62183: Improper Privilege Management

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

Exploit for Race Condition in Apple Ipados

CVE-2026-28992 — IOHIDFamily FastPathUserClient PoC Security...

Identity Lifecycle Management Wasn't Built for AI Agents 

Identity lifecycle management was architected around a person with an employment record, a manager, and a departure date. AI agents have none of those. As autonomous principals proliferate across enterprise environments, the governance model built for humans develops structural blind spots that...

CVE-2026-42890

Actual is an open-source personal finance application. In the macOS desktop application version 25.x built on Electron 39.2.7, the ELECTRONRUNASNODE fuse is not disabled, allowing an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app binary wit...

CVE-2026-24064

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC client component included with the product is signed with hardened runtime entitlements that permit dynamic library injection. A local attacker can set the DYLDINSERTLIBRARIES...

actual Allows Electron to Run As Node

Summary A electron run as node vulnerability was identified in actual macOS application, version 25.x Electron 39.2.7. Vulnerability Type: Electron Run As Node Description ELECTRONRUNASNODE fuse enabled Electron 39.2.7 — app can be converted to Node.js REPL for arbitrary code execution Impact An...

PT-2026-47599

Name of the Vulnerable Software and Affected Versions Actual versions prior to 26.5.0 Description In the macOS desktop application, the ELECTRON RUN AS NODE fuse is not disabled. This allows an attacker who can place a file on disk or control command-line arguments to invoke the signed Actual.app...

PT-2026-47558

Summary A electron run as node vulnerability was identified in actual macOS application, version 25.x Electron 39.2.7. Vulnerability Type: Electron Run As Node Description ELECTRON RUN AS NODE fuse enabled Electron 39.2.7 — app can be converted to Node.js REPL for arbitrary code execution Impact ...

The Role of Domain-Specific Features in Malware Detection: A MacOS Case Study

Despite the growing popularity of macOS among end users and enterprise systems, malware research has primarily focused on Windows and Android operating systems, leaving the problem of macOS malware detection relatively unexplored. Indeed, the specificity of the operating system and the unique...