68 matches found
CVE-2026-84636-PoC
CVE-2026-84636 A sandboxed iOS app with no special entitlements can call SCDynamicStoreCreate and SCDynamicStoreCopyValue to read the current WiFi SSID SSIDSTR and router MAC address ARPResolvedHardwareAddress directly from configd's network state store. This bypasses the...
Dr.Web ConfigD Executable Buffer Overflow DoS
The vulnerability of the Dr.Web ConfigD executable module is related to insufficient protection of operational data. Exploiting this vulnerability can allow attackers to disclose the protected information...
cve-2022-31749
CVE-2022-31749 by 1vere$k Simple PoC-checker for CVE-2022-31749 by 1vere$k. It exploits a parameter injection vulnerability in the WatchGuard SSH interface. The vulnerability allows a low privileged user to exfiltrate arbitrary system files to an attacker controlled FTP server. Fortunately, there...
Apple MacOS: CVE-2026-112545: OS X update for configd
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges...
PT-2026-107721
Уязвимость исполняемого модуля Dr.Web ConfigD связана с недостаточной защитой служебных данных. Эксплуатация уязвимости может позволить нарушителю раскрыть защищаемую информацию...
configd daemon in operating
The vulnerability of the configd daemon in macOS operating systems is related to integer overflow. Exploiting this vulnerability allows a remote attacker to compromise the accessibility of protected information...
CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...
CVE-2026-30868
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...
CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...
CVE-2026-30868 Cross-Site Request Forgery (CSRF) in opnsense/core
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...
CVE-2026-30868
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...
CVE-2026-30868
OPNsense/CVE-2026-30868 is a CSRF flaw in the FreeBSD-based firewall platform where multiple MVC API endpoints allow state-changing actions via HTTP GET without CSRF protection. The CSRF validation in ApiControllerBase applies only to POST/PUT/DELETE, enabling an authenticated user to trigger pri...
CVE-2026-30868: Cross-Site Request Forgery (CSRF)
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...
PT-2026-24742
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.4, multiple OPNsense MVC API endpoints perform state‑changing operations but are accessible via HTTP GET requests without CSRF protection. The framework CSRF validation in ApiControllerBase only applies to POST/PUT/DELETE...
EUVD-2020-12489
Malware in sbrugna...
EUVD-2020-12488
Malware in sbrugna...
EUVD-2021-7537
Malicious code in bioql PyPI...
CVE-2025-6183 Configd Injection
The StrongDM macOS client incorrectly processed JSON-formatted messages. Attackers could potentially modify macOS system configuration by crafting a malicious JSON message...
CVE-2025-6183 Configd Injection
The StrongDM macOS client incorrectly processed JSON-formatted messages. Attackers could potentially modify macOS system configuration by crafting a malicious JSON message...
