CVE-2019-8734

CVE-2019-8734 involves memory corruption issues that Apple and related platforms addressed by memory management fixes. Publicly documented fixes include iOS 13, iCloud for Windows 7.14 and 10.7, Safari 13, tvOS 13, watchOS 6, and iTunes 12.10.1 for Windows. The description notes that processing m...

CVE-2019-8715

CVE-2019-8715 is a memory corruption vulnerability in PluginKit that could allow an attacker to execute arbitrary code with system privileges. Apple pages indicate the issue is fixed in macOS Catalina 10.15.1 and Security Updates 2019-001/006 (macOS Catalina 10.15 and iOS 13). Connected docs do n...

CVE-2019-8715

A memory corruption issue was addressed with improved memory handling. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15, iOS 13. An application may be able to execute arbitrary code with system privileges...

CVE-2019-8709

CVE-2019-8709 is a memory-corruption issue in Apple platforms that may allow an application to execute arbitrary code with kernel privileges. Concrete details from connected documents indicate this affects macOS (kernel), and that patches are provided in macOS Catalina 10.15, macOS Catalina 10.15...

CVE-2019-8708

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, macOS Catalina 10.15, iOS 13. A local user may be able to check for the existence of arbitrary files...

CVE-2019-8708

CVE-2019-8708 is a local-privilege issue in macOS components where a local user could determine the existence of arbitrary files. The entry documents a logic/restrictions problem that is addressed by fixes in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, and also...

CVE-2019-8674

A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting...

JITSploitation III: Subverting Control Flow

Posted by Samuel Groß, Project Zero This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed i...

Security Bulletin: MaaS360 has identified a vulnerability in the MaaS360 iOS Application. (CVE-2019-4735)

Summary A vulnerability was identified and remediated in the IBM MaaS360 for iOS Application Version 3.96.62. Vulnerability Details CVEID: CVE-2019-4735 DESCRIPTION: IBM MaaS360 for iOS could allow an attacker with physical access to the device to obtain sensitive information from the agent outsi...

ProficySCADA for iOS 5.0.25920 - Password Denial of Service (PoC)

ProficySCADA for iOS 5.0.25920 - Password Denial of Service PoC Exploit Title: ProficySCADA for iOS 5.0.25920 - 'Password' Denial of Service PoC Author: Ivan Marmolejo Date: 2020-03-22 Vendor Homepage: https://apps.apple.com/us/app/proficyscada/id525792142 Software Link: App Store for iOS devices...

iOSmacOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand()

iOSmacOS - Out-of-Bounds Timestamp Write in IOAccelCommandQueue2::processSegmentKernelCommand While investigating possible shared memory issues in AGXCommandQueue::processSegmentKernelCommand, I noticed that the size checks used to parse the IOAccelKernelCommand in...

CVE-2019-8760

This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID...

CVE-2019-8742

The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 13. A person with physical access to an iOS device may be able to access contacts from the lock screen...

CVE-2019-8727

A logic issue was addressed with improved state management. This issue is fixed in iOS 13. Visiting a malicious website may lead to address bar spoofing...

CVE-2019-8711

A logic issue existed with the display of notification previews. This issue was addressed with improved validation. This issue is fixed in iOS 13. Notification previews may show on Bluetooth accessories even when previews are disabled...

CVE-2019-8674

A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting...

Cross site scripting

A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting...

Information disclosure

The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 13. A person with physical access to an iOS device may be able to access contacts from the lock screen...

Design/Logic Flaw

A logic issue was addressed with improved state management. This issue is fixed in iOS 13. Visiting a malicious website may lead to address bar spoofing...

Design/Logic Flaw

This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID...