28561 matches found
CVE-2025-5317: Missing Authorization
An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac BEST before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the...
The vulnerability of the Assets component in iOS, iPadOS, macOS, tvOS, and visionOS allows attackers to bypass the sandbox protection mechanism.
The vulnerability of the Assets component in iOS, iPadOS, macOS, tvOS, and visionOS is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to bypass the sandbox protection mechanisms...
Microsoft Excel 缓冲区错误漏洞
Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information disclosure vulnerability exists in Microsoft Excel, which can be exploited by attackers to obtain sensitive information...
Microsoft Excel 资源管理错误漏洞
Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. A code execution vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on a system...
Microsoft Office 资源管理错误漏洞
Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, and so on. A code execution vulnerability exists in Microsoft Office, which can be exploited by an attacker to...
Microsoft Excel 缓冲区错误漏洞
Microsoft Excel is a spreadsheet processing software in the Office suite from Microsoft USA. An information leakage vulnerability exists in Microsoft Excel, which can be exploited by an attacker to execute arbitrary code on the system...
Mozilla Firefox ESR < 140.5
The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 140.5. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-88 advisory. - Use-after-free in the WebRTC: Audio/Video component. This vulnerability affects Firefox 145 and Firefox...
Stable Channel Update for Desktop
The Stable channel has been updated to 142.0.7444.162/.163 for Windows and 142.0.7444.162 for Mac and 142.0.7444.162 for Linux, which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and...
CVE-2025-43079
The Qualys Cloud Agent included a bundled uninstall script qagentuninstall.sh, specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges...
CVE-2025-43079
The Qualys Cloud Agent included a bundled uninstall script qagentuninstall.sh, specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges...
AlmaLinux 10 : kernel (ALSA-2025:19469)
The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:19469 advisory. kernel: ipv6: sr: Fix MAC comparison to be constant-time CVE-2025-39702 kernel: kernfs: Fix UAF in polling when open file is released CVE-2025-39881...
Apple macOS Sequoia Code Signature Limit Insufficiency Vulnerability
Apple macOS Sequoia is an operating system announced by Apple on June 10, 2024 at the WWDC24 developer conference. Apple macOS Sequoia suffers from an insufficient code signature restriction vulnerability that can be exploited by an attacker to access sensitive user data...
CVE-2025-43079: Untrusted Search Path
The Qualys Cloud Agent included a bundled uninstall script qagentuninstall.sh, specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges...
Fake CAPTCHA sites now have tutorial videos to help victims install malware
Early on in 2025, I described how criminals used fake CAPTCHA sites and a clipboard hijacker to provide instructions for website visitors that would effectively infect their own machines with an information stealer known as the Lumma Stealer. ClickFix is the name researchers have since given to...
AlmaLinux 9 : kernel (ALSA-2025:19409)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:19409 advisory. kernel: ipv6: sr: Fix MAC comparison to be constant-time CVE-2025-39702 kernel: fs: fix UAF/GPF bug in nilfsmdtdestroy CVE-2022-50367 kernel: crypto: xts...
CVE-2025-11216
Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video file. Chromium security severity: Low...
CVE-2025-11216
Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video file. Chromium security severity: Low...
CVE-2025-11216
Google Chrome on Mac versions prior to 141.0.7390.54 is vulnerable to domain spoofing due to an inappropriate implementation in the Storage component. A remote attacker can exploit this by providing a crafted video file . The Chromium security severity is rated as Low . Remediation is available i...
