CocoaPods-RCE_CVE-2024-38366

CocoaPods-RCE このリポジトリには、CocoaPods パッケージマネージャーの調査と分析の過程で発見された RCE 脆弱性に関する、研究プロセスと考察のより詳細な内容が含まれています。 研究発表のブログ記事はこちらで読めます： https://www.evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods 研究の背景 CocoaPods Trunk Server は、Apple エコシステム（特に iOS および macOS 開発）で使用される...

JFrog Artifactory 7.146.x < 7.146.36 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.146.x prior to 7.146.36. It is, therefore, affected by multiple vulnerabilities: - A user who can read an existing remote VCS repository can replace its configured origin or supply an...

CVE-2026-70548

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-70548

This SSRF vulnerability affects JFrog Artifactory (Self-Managed) through its External Dependency feature related to CocoaPods . Under specific circumstances, a low-privilege user can issue requests to remote CocoaPods repositories, potentially leveraging Artifactory as a proxy. The CVSS v3.1 scor...

CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

EUVD-2026-65543

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

PT-2026-81353

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

CVE-2026-70548: Server-Side Request Forgery (SSRF)

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...

Supply Chain Insecurity: Exposing Vulnerabilities in IOS Dependency Management Systems

Dependency management systems are a critical component in software development, enabling projects to incorporate existing functionality efficiently. However, misconfigurations and malicious actors in these systems pose severe security risks, leading to supply chain attacks. Despite the widespread...

Malicious code in cocoapod (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-192904 Malicious code in cocoapod (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

EUVD-2022-1732

Malicious code in bioql PyPI...

EUVD-2024-37282

Malicious code in bioql PyPI...

EUVD-2024-37281

Malicious code in bioql PyPI...

EUVD-2022-1661

Malicious code in bioql PyPI...

MAL-2025-1555 Malicious code in luno-cocoapods (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9bb59e6b577e1a28cf71bf254ef70a0641db3319c1985827f792edb51ea14493 The OpenSSF Package Analysis project identified 'luno-cocoapods' @ 2.8.0 rubygems as malicious. It is considered malicious because: - The packag...

Malicious code in luno-cocoapods (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9bb59e6b577e1a28cf71bf254ef70a0641db3319c1985827f792edb51ea14493 The OpenSSF Package Analysis project identified 'luno-cocoapods' @ 2.8.0 rubygems as malicious. It is considered malicious because: - The packag...

The vulnerability of the dependency manager for Swift and Objective-C CocoaPods exists due to the lack of measures taken to neutralize special elements, allowing attackers to execute arbitrary code.

The vulnerability of dependency managers for Swift and Objective-C CocoaPods exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of dependency managers for Swift and Objective-C CocoaPods, related to the provision of data elements during an erroneous session, allows a perpetrator to intercept the owner’s session and take control of another person’s CocoaPods trunk account.

The vulnerability of the dependency manager for Swift and Objective-C CocoaPods relates to the provision of data elements during an erroneous session. Exploiting this vulnerability can allow a remote attacker to intercept the user’s session and take control of their CocoaPods trunk account...