CVE-2018-4047

An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root...

CVE-2018-4046

CleanMyMac X (MacPaw) version 4.04 contains a locally exploitable denial-of-service vulnerability in the helper service, specifically the pleaseTerminate function, caused by improper input validation. An attacker with local access can cause the root daemon to terminate itself, effectively crossin...

CVE-2018-4043

An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with local access can use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a successful...

CVE-2018-4041

An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root...

CVE-2018-4042

An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root...

CVE-2018-4045

CVE-2018-4045 affects CleanMyMac X 4.04. The vulnerability resides in the securelyRemoveItemAtPath function of the helper protocol, where a user-supplied argument is passed to securelyRemoveFileAtPath without validation. An attacker with local access could exploit this to delete files from the ro...

CVE-2018-4045

An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root...

CVE-2018-4043

Summary of CVE-2018-4043 and related details: CleanMyMac X (version 4.04) is affected by a set of local privilege-escalation vulnerabilities in the helper protocol. The root cause across these flaws is improper input validation and lack of validation of the calling application in various function...

CVE-2018-4044

CVE-2018-4044 affects Clean My Mac X, version 4.04. The vulnerability exists in the helper protocol’s removePackageWithID function, where calling applications can pass the privileged command via an unvalidated path. Attackers with local access could exploit this to delete package receipts using t...

CVE-2018-4044

An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root...

CVE-2018-4042

CVE-2018-4042 affects CleanMyMac X 4.04. The vulnerability is in the helper service’s removeLaunchdAgentAtPath function, where there is no validation of the calling application, allowing a local attacker to run as root and modify/delete root-owned files. The advisory notes this is addressed by up...

CVE-2018-4047

An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root...

Clean My Mac X securelyRemoveItemAtPath privilege escalation vulnerability

Summary An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root. Tested Versions Clean My Mac X 4.04 Product...

Clean My Mac X enableLaunchdAgentAtPath privilege escalation vulnerability

Summary An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root. Tested Versions Clean My Mac X 4.04 Product...

Clean My Mac X pleaseTerminate denial-of-service vulnerability

Summary An exploitable denial-of-service vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. A user with local access can use this vulnerability to terminate a privileged helper application. An attacker would need local access to the machi...

Clean My Mac X removeASL Privilege Escalation Vulnerability

Summary An exploitable privilege escalation vulnerability exists in the Clean My Mac X, version 4.04, helper service due to improper input validation. A user with local access can use this vulnerability to modify the file system as root. An attacker would need local access to the machine for a...

Clean My Mac X removeLaunchdAgentAtPath privilege escalation vulnerability

Summary An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root. Tested Versions Clean My Mac X 4.04 Product...

Clean My Mac X disableLaunchdAgentAtPath privilege escalation vulnerability

Summary An exploitable privilege escalation vulnerability exists in the helper service of Clean My Mac X, version 4.04, due to improper input validation. An attacker with local access could exploit this vulnerability to modify the file system as root. Tested Versions Clean My Mac X 4.04 Product...

Command injection

The MXQ TV Box 4.4.2 Android device with a build fingerprint of MBX/m201N/m201N:4.4.2/KOT49H/20160106:user/test-keys contains the Android framework with a package name of android versionCode=19, versionName=4.4.2-20170213 that contains an exported broadcast receiver application component that, wh...

AZL-6806 CVE-2018-19787 affecting package python-lxml for versions less than 4.8.0-1

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to...