CVE-2024-43468_mTLS_go

CVE-2024-43468 SCCM SQL 注入利用（基于 macOS 钥匙串的 mTLS 客户端证书版本） 使用 macOS 钥匙串进行 mTLS 认证（无需从钥匙串导出密钥）的 CVE-2024-43468 利用的 Go 实现。 此外： 增加了代理支持，避免使用有问题的 proxychains。 增加了 getcertname.py 用于获取证书通用名称（是的，你也可以手动从钥匙串访问 GUI 中获取）。 增加了大量调试信息，以便了解实际运行情况。 基于： 原始 Python 利用 mTLS Go 客户端示例 描述 利用 Microsoft Configuration...

CVE-2026-57441

MCPVault , a lightweight Model Context Protocol server for safe file access in an Obsidian vault , contains a path-filter bypass in PathFilter (src/pathfilter.ts) prior to 0.11.4 . The deny-list for restricted directories (.git, .obsidian, node_modules) is compiled case-sensitively and compared w...

CVE-2025-49173

CVE-2025-49173 — Escalada de Privilegios Local a Root en macOS 10.9 Investigación Estado: No oficial / Basado en investigación Plataforma: macOS Mavericks 10.9 Impacto: Escalada de Privilegios Local → Root Severidad: Alta Local Este repositorio contiene un proyecto de investigación de seguridad d...

memdumper

memdumper memdumper 在另一个已签名二进制的调试器授权（debugger entitlement）下读取正在运行的 macOS 进程的内存。其目的是让 taskforpid 和 ptrace 以该已获授权二进制身份运行，这样 EDR 记录的是它，而不是 memdumper。 作者：cenobyte [email protected] 2026 https://github.com/cenobyte-vincit/memdumper 概述 memdumper 启动一个带有 com.apple.security.cs.debugger 以及两个允许...

CVE-2026-77179

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

Ph-n-t-ch-CVE-2024-40842-XProtectRemediatorDubRobber-Information-Leak-tr-n-macOS

CVE-2024-40842: XProtectRemediatorDubRobber Information Leak on macOS Overview CVE-2024-40842 is a local information disclosure vulnerability in Apple's XProtect Remediator on macOS, related to the module: XProtectRemediatorDubRobber The vulnerability stems from Apple's privileged security proces...

rinhit

RinHit RinHit - macOS 生态系统侦察框架。从 Apple 生态系统中收集痕迹，构建网络活动、跨设备身份和物理位置关联的时间线。 这是开源侦察模块。闭源 Swift 载荷（rinhit-agent）由我们的红队内部使用，不属于本仓库。 功能 Wi-Fi 网络侦察 - 解析 com.apple.wifi.known-networks.plist（旧版）或使用 networksetup（macOS 15+ Data Vault） 蓝牙设备 - 来自 com.apple.Bluetooth.plist 的已配对、缓存和已连接设备 USB 设备历史 - 通过 ioreg...

CVE-2018-4121

CVE-2018-4121 - Safari Wasm Sections POC RCE Exploit by MWR Labs c 2018 详情 此概念验证漏洞利用程序仅针对 macOS 10.13.3 17D47 上的 Safari 11.0.3 13604.5.6 版本。 将你选择的有效载荷编译为带有构造函数的动态库 dylib 运行 python filetojsarray.py your.dylib payload.js 提供此目录服务，并将 Safari 指向 /exploit.html 该漏洞利用并非完全可靠，并且为此 macOS/Safari 版本使用了硬编码偏移量。...

jitsploitation

jitsploitation 古いJITバグであるCVE-2020-9802のiOSブラウザエクスプロイト。 これは、Project Zeroによって元々文書化された、macOSおよびiOS向けWebKitエンジンにおける人気のJITコンパイラバグのエクスプロイトです。私はブラウザエクスプロイトの学習演習として、このバグのエクスプロイトを再実装しました。 動画解説: 1クリックであなたのiPhoneをハックする方法 クレジット ProjectZero blog JakeBlair420の実装...

Mozilla Firefox < 156.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 156.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-90 advisory. - Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefox ESR...

CVE-2026-86905

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain...

CVE-2026-86924

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7. Connecting a malicious accessory may cause unexpected system termination...

CVE-2026-86910

A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files...

CVE-2026-86902

A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8.8. An app may be able to access sensitive user data...

CVE-2026-86911

This issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. A malicious app may be able to bypass clickjacking protections for secure prompts...

CVE-2026-86909

A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks...

CVE-2026-86917

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges...

CVE-2026-86901

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure...

CVE-2026-86894

A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox...

CVE-2026-86891

An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS 27. An app may be able to access Bluetooth device information...