The vulnerability of the TCC component in operating systems for macOS, iOS, and iPadOS allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the TCC component in macOS, iOS, and iPadOS is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability can allow a malicious individual to gain unauthorized access to protected information...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

CVE-2024-54463

This issue was addressed with improved entitlements. This issue is fixed in macOS Sequoia 15. An app may be able to access removable volumes without user consent...

CVE-2024-54463

CVE-2024-54463 affects macOS Sequoia 15, where an app could access removable volumes without user consent due to entitlements checks. Apple fixed the issue in Sequoia 15 by improving entitlements handling. Practical impact per sources: potential leakage of data from removable volumes if an app la...

Apple macOS 信息泄露漏洞

Apple macOS is a suite of specialized operating systems from the U.S.-based Apple Inc. developed specifically for Mac computers. A security vulnerability exists in Apple macOS that stems from a privilege improvement that could cause an application to access removable volumes without user consent...

CVE-2025-25113

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through = 1.3...

CVE-2025-25113

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through = 1.3...

CVE-2025-25113 WordPress Implied Cookie Consent plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Senktec Implied Cookie Consent implied-cookie-consent allows Reflected XSS.This issue affects Implied Cookie Consent: from n/a through = 1.3...

CVE-2025-25113

CVE-2025-25113 concerns WordPress plugin “Implied Cookie Consent” (versions up to 1.3). Connected sources note a Reflected Cross‑Site Scripting (XSS) vulnerability arising from improper input neutralization in the plugin, enabling reflected XSS in affected pages. The initial entry identifies the ...

CVE-2025-25113 WordPress Implied Cookie Consent plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Implied Cookie Consent allows Reflected XSS. This issue affects Implied Cookie Consent: from n/a through 1.3...

WordPress plugin Implied Cookie Consent 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

ASB-A-304497167

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

DeepSeek found to be sharing user data with TikTok parent company ByteDance

A couple of weeks ago we reported on the concerns surrounding data collection and security at DeepSeek, the Chinese AI company which recently made headlines for shaking up the industry after seemingly appearing from nowhere to become top of the app download charts. Now South Korea’s Personal...

Gambling firms are secretly sharing your data with Facebook

While you might think you’re hitting the jackpot, whether you’ve consented to it or not, online gambling sites are playing with your data. Users’ data, including details of webpages they visited and buttons they clicked, are being shared with Meta, Facebook’s parent company. The Observer reports...

CVE-2024-4869

The WP Cookie Consent for GDPR, CCPA & ePrivacy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Client-IP’ header in all versions up to, and including, 3.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2024-36437

The com.enflick.android.TextNow aka TextNow: Call + Text Unlimited application 24.17.0.2 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.enflick.android.TextNow.activities.DialerActivity...

WordPress Implied Cookie Consent plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Implied Cookie Consent versions = 1.3...

ASB-A-372670004

In onCreate of MediaProjectionPermissionActivity.java, there is a possible way to bypass user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...