PT-2018-1295

Name of the Vulnerable Software and Affected Versions IPVanish version 3.0.11 for macOS Description The issue is related to the com.ipvanish.osx.vpnhelper LaunchDaemon, which implements an insecure XPC service. This allows an attacker to execute arbitrary code as the root user by sending speciall...

CVE-2018-9105: Improper Authentication

NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately...

PT-2018-18854

Name of the Vulnerable Software and Affected Versions NordVPN version 3.3.10 for macOS Description The issue arises from the privileged helper tool's implemented XPC service, which is responsible for receiving and processing new OpenVPN connection requests. This XPC service is not protected,...

Type confusion

ZenMate 1.5.4 for macOS suffers from a type confusion vulnerability within the com.zenmate.chron-xpc LaunchDaemon component. The LaunchDaemon implements an XPC service that uses an insecure XPC API for accessing data from an inbound XPC message. This could potentially result in an XPC object of t...

Privilege escalation

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

Privilege escalation

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

CVE-2018-7716

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

CVE-2018-7716

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

CVE-2018-7716

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

CVE-2018-7715

CVE-2018-7715 affects PrivateVPN 2.0.31 for macOS via the com.privat.vpn.helper XPC service. The XPC interface allows arbitrary installed apps to connect and send a message containing a path string intended to point to PrivateVPN’s internal openvpn binary. If no connection has been established ye...

CVE-2018-7716

PrivateVPN for macOS (v2.0.31) suffers a root privilege escalation via its com.privat.vpn.helper XPC service. The XPC interface accepts a config string that should reference an internal OpenVPN configuration, but an attacker can send a malicious XPC message directing the service to a config file ...

CVE-2018-7715: Undefined Security Weakness

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

PT-2018-1166

Name of the Vulnerable Software and Affected Versions PrivateVPN version 2.0.31 for macOS Description The issue is related to the com.privat.vpn.helper privileged helper tool, which implements an XPC service. This service allows any installed application to connect and send messages, extracting a...

PT-2018-1167

Name of the Vulnerable Software and Affected Versions PrivateVPN version 2.0.31 for macOS Description The issue is related to insufficient access control in the com.privat.vpn.helper component, which implements an XPC service for the PrivateVPN software. This allows a remote attacker to execute...

CVE-2018-7716: Undefined Security Weakness

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

Privilege escalation

DISPUTED PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for...

CVE-2018-7311

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new...

CVE-2018-7311

PrivateVPN 2.0.31 for macOS contains a root privilege escalation via a privileged helper launched as a LaunchDaemon with an XPC service. The helper executes the openvpn binary located under /Applications/PrivateVPN.app/Contents/Resources to establish VPN connections; the binary can be overwritten...

CVE-2018-7311

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new...

CVE-2018-7311: Incorrect Permission Assignment for Critical Resource

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new...