PT-2022-15569 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Monterey 12.3 macOS versions prior to Big Sur 11.6.5 macOS Catalina versions prior to Security Update 2022-003 Description: A maliciously crafted ZIP archive may bypass Gatekeeper checks. This issue was addressed with...

PT-2022-15611 · Apple · Macos Monterey +6

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 15.4 iPadOS versions prior to 15.4 macOS Big Sur versions prior to 11.6.6 macOS Monterey versions prior to 12.3 macOS Catalina versions prior to Security Update 2022-004 Description: A malicious application may bypass...

Apple macOS Big Sur 输入验证错误漏洞

Apple macOS Big Sur is the 17th major version of Apple's macOS Big Sur, Apple's operating system for the MAC, macOS. Apple macOS Big Sur 11.6.5 previously contained an input validation error vulnerability that stemmed from a maliciously crafted ZIP archive that could bypass Gatekeeper checks...

About the security content of macOS Monterey 12.3

About the security content of macOS Monterey 12.3 This document describes the security content of macOS Monterey 12.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...

GHSA-JH6M-3PQW-242H Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers

A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers via cURL we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers e.g. Jetty. This means there is no protection when we put a Gatekeeper in...

Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers

A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers via cURL we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers e.g. Jetty. This means there is no protection when we put a Gatekeeper in...

The evolution of a Mac trojan: UpdateAgent’s progression

Our discovery and analysis of a sophisticated Mac trojan in October exposed a year-long evolution of a malware family—and depicts the rising complexity of threats across platforms. The trojan, tracked as UpdateAgent, started as a relatively basic information-stealer but was observed distributing...

Apple Pays $100,500 Bounty to Hacker Who Found Way to Hack MacBook Webcam

Apple last year fixed a new set of macOS vulnerabilities that exposed Safari browser to attack, potentially allowing malicious actors to access users' online accounts, microphone, and webcam. Security researcher Ryan Pickren, who discovered and reported the bugs to the iPhone maker, was compensat...

Exploit for Out-of-bounds Write in Apple Macos

CVE-2021-30853 A simple POC script to test for CVE-2021-30657...

Old Gatekeeper bypass vulnerability in macOS exploited

THREAT LEVEL: Amber For a detailed advisory, download the pdf file here A gatekeeper bypass vulnerability exists in macOS Big Sur and has been assigned CVE-2021-30853. An attacker can exploit this issue by using a specially-crafted script-based application downloaded from the Internet. This allow...

Expert Details macOS Bug That Could Let Malware Bypass Gatekeeper Security

Apple recently fixed a security vulnerability in the macOS operating system that could be potentially exploited by a threat actor to "trivially and reliably" bypass a "myriad of foundational macOS security mechanisms" and run arbitrary code. Security researcher Patrick Wardle detailed the discove...

macOS 12.x < 12.1 Multiple Vulnerabilities (HT212978)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.1. It is, therefore, affected by multiple vulnerabilities: - An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.1. A device may be passively tracked via BSSIDs...

GHSA-HX6G-Q9V2-XH7V Information exposure in elgg

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'...

About the security content of macOS Big Sur 11.6.2

About the security content of macOS Big Sur 11.6.2 This document describes the security content of macOS Big Sur 11.6.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

About the security content of Security Update 2021-008 Catalina

About the security content of Security Update 2021-008 Catalina This document describes the security content of Security Update 2021-008 Catalina. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has...

About the security content of macOS Monterey 12.1

About the security content of macOS Monterey 12.1 This document describes the security content of macOS Monterey 12.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...

CVE-2021-43979

Styra Open Policy Agent OPA Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish...

CVE-2021-43979

Styra Open Policy Agent OPA Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish...

CVE-2021-43979

Styra Open Policy Agent OPA Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication to finish...

Design/Logic Flaw

DISPUTED Styra Open Policy Agent OPA Gatekeeper through 3.7.0 mishandles concurrency, sometimes resulting in incorrect access control. The data replication mechanism allows policies to access the Kubernetes cluster state. During data replication, OPA/Gatekeeper does not wait for the replication t...