Simple macOS kernel extension fuzzing in userspace with IDA and TinyInst

Posted by Ivan Fratric, Google Project Zero Recently, one of the projects I was involved in had to do with video decoding on Apple platforms, specifically AV1 decoding. On Apple devices that support AV1 video format starting from Apple A17 iOS / M3 macOS, decoding is done in hardware. However,...

WordPress Plugin 'Really Simple Security Pro Multisite' 9.0.0 < 9.1.2 Authentication Bypass

The WordPress application running on the remote host has a version of the 'Really Simple Security Pro Multisite' plugin that is 9.0.x prior to 9.1.2. It is, therefore, affected by an authentication bypass vulnerability. This is due to improper user check error handling in the two-factor REST API...

The vulnerability of the “Delegate my view right” function in the PDF viewer macro of the XWiki PDF Viewer Macro (Pro) allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the “Delegate my view right” function in the PDF viewer macro of XWiki PDF Viewer Macro Pro relates to the display of confidential information in the source code comments. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access t...

The vulnerability of the Simple Key-Management for Internet Protocol (SKIP) protocol implementation in the PDF viewer macro of the XWiki PDF Viewer (Pro) allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the SKIP protocol implementation in the PDF viewer macro of XWiki PDF Viewer Macro Pro relates to the improper generation of keys. Exploiting this vulnerability may allow an attacker, operating remotely, to gain unauthorized access to protected information...

WordPress Plugin 'Really Simple Security Pro' 9.0.0 < 9.1.2 Authentication Bypass

The WordPress application running on the remote host has a version of the 'Really Simple Security Pro' plugin that is 9.0.x prior to 9.1.2. It is, therefore, affected by an authentication bypass vulnerability. This is due to improper user check error handling in the two-factor REST API actions wi...

CVE-2024-52450

CVE-2024-52450 describes an Unauthenticated Local File Inclusion in the WordPress plugin “nBlocks” (versions up to and including 1.0.2) caused by improper control of filenames in PHP Include/Require statements. Public sources in the Connected documents confirm the issue affects nBlocks from n/a t...

CVE-2024-51903

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brandon Hubbard WP Listings Pro wp-listings-pro allows Stored XSS.This issue affects WP Listings Pro: from n/a through = 3.0.14...

CVE-2024-50532

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through = 0.1...

CVE-2024-50532

CVE-2024-50532 affecting WordPress plugin Events Manager Pro – extended (versions

CVE-2024-50532 WordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through = 0.1...

CVE-2024-50532 WordPress Events Manager Pro – extended plugin <= 0.1 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jerin K Alexander Events Manager Pro – extended events-manager-pro-extended allows Reflected XSS.This issue affects Events Manager Pro – extended: from n/a through = 0.1...

CVE-2024-51812 WordPress Pro Addons For Elementor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Wasim Pro Addons For Elementor pro-addons-for-elementor allows Stored XSS.This issue affects Pro Addons For Elementor: from n/a through = 1.5.0...

CVE-2024-51903 WordPress WP Listings Pro plugin <= 3.0.14 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brandon Hubbard WP Listings Pro wp-listings-pro allows Stored XSS.This issue affects WP Listings Pro: from n/a through = 3.0.14...

CVE-2024-51903 WordPress WP Listings Pro plugin <= 3.0.14 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brandon Hubbard WP Listings Pro wp-listings-pro allows Stored XSS.This issue affects WP Listings Pro: from n/a through = 3.0.14...

CVE-2024-51903

CVE-2024-51903 is a Stored XSS in the WordPress plugin WP Listings Pro (affected: WP Listings Pro, versions

WordPress plugin WP Listings Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Events Manager Pro – extended 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2024-35035 · Unknown · Imforza Wp Listings Pro

Name of the Vulnerable Software and Affected Versions: imFORZA WP Listings Pro versions prior to 3.0.15 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically Stored XSS. This allows...

PT-2024-34939 · Elementor · Rraddons For Elementor

Name of the Vulnerable Software and Affected Versions: Pro Addons For Elementor versions 1.5.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This enables malicious scri...

About the security content of visionOS2.1.1

About the security content of visionOS2.1.1 This document describes the security content of visionOS 2.1.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...