242 matches found
macphish
macphish Generador de Payloads de Macros para Office en Mac Vectores de ataque Hay 4 vectores de ataque disponibles: beacon creds meterpreter meterpreter-grant Para el método 'creds', macphish puede generar el script de Applescript directamente, en caso de que necesites ejecutarlo desde un shell...
CVE-2026-59111
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...
CVE-2026-59111 Command Injection vulnerability in eObčanka-Identifikace
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...
CVE-2026-59111
CVE-2026-59111 is an OS command injection vulnerability in the Digitální a informační agentura (DIA) eObčanka-Identifikace macOS application. Prior to version 3.6.0 , incoming URL parameters were passed to the compiled AppleScript wrapper via concatenation without sufficient sanitization, allowin...
EUVD-2026-68596
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...
GHSA-HRJ8-HJV8-MGWC Anyquery: AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin
AppleScript/JXA Code Injection via Unescaped URL in macOS Chrome Plugin | Field | Value | | ---------------- | ----- | | Repository | julien040/anyquery | | Affected version | 0.4.4 commit 0abd460 | | Vulnerability | CWE-94 — Improper Control of Generation of Code | | Severity | High | Summary Th...
PT-2026-47613
Name of the Vulnerable Software and Affected Versions anyquery version 0.4.4 Description The chrome tabs plugin including Brave, Edge, and Safari variants allows for AppleScript and JXA code injection on macOS hosts. The issue occurs because a SQL-controlled url value is interpolated directly int...
EUVD-2026-34619
Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. Chromium security severity: Medium...
DEBIAN-CVE-2026-11158
Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. Chromium security severity: Medium...
CVE-2026-11158
Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. Chromium security severity: Medium...
PT-2026-46685
Name of the Vulnerable Software and Affected Versions Google Chrome on Mac versions prior to 149.0.7827.53 Description Insufficient validation of untrusted input in Downloads allows a local attacker to potentially perform a sandbox escape, which is a process of breaking out of a restricted...
Google Chrome 输入验证错误漏洞
Google Chrome is a web browser developed by Google Inc. Versions of Google Chrome prior to 149.0.7827.53 had a vulnerability related to input validation. This vulnerability stemmed from insufficient validation of untrusted inputs, which could allow local attackers to escape the sandbox through...
CVE-2026-0236
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser...
CVE-2026-0236 Prisma Browser: Code Injection Enables Security Controls Bypass
A code injection vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to its AppleScript interface allowing a locally authenticated non-admin user to leverage this exposed Apple Event handler to send unauthorized commands to the browser...
PT-2026-40748
Name of the Vulnerable Software and Affected Versions Prisma Browser on macOS affected versions not specified Description A code injection issue exists where the software fails to properly restrict access to its AppleScript interface. This allows a locally authenticated non-admin user to use an...
CVE-2026-34779
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder used an AppleScript fallback path that did not properly handle certain characters in the...
The vulnerability of AppleScript components in macOS operating systems allows attackers to compromise the integrity of protected information.
The vulnerability of AppleScript components in macOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the integrity of protected information...
CVE-2026-34779
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on macOS, app.moveToApplicationsFolder used an AppleScript fallback path that did not properly handle certain characters in the...
Electron: AppleScript injection in app.moveToApplicationsFolder on macOS
Impact On macOS, app.moveToApplicationsFolder used an AppleScript fallback path that did not properly handle certain characters in the application bundle path. Under specific conditions, a crafted launch path could lead to arbitrary AppleScript execution when the user accepted the...