CVE-2026-20660

CVE-2026-20660 PoC バンドル このフォルダには、以下に対するスタンドアロンの概念実証（PoC）がパッケージされています： CVE-2026-20660 CFNetwork NSGZipDecoder の gzip FNAME を介したパストラバーサル 自動開封が有効な脆弱な macOS Safari への影響 1. ディレクトリ構成 server.py: トラバーサル深度とターゲット名を設定可能なメイン PoC サーバー serveroverwrite.py: ../../pwn.sh を書き込む特化バリアント README.md: 再現メモと操作ログ 2. 前提条件...

EUVD-2025-3654

Malicious code in bioql PyPI...

CVE-2025-24201

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.2 and iPadOS 18.3.2, iPadOS 17.7.6, macOS Sequoia 15.3.2, visionOS 2.3.2, watchOS 11.4...

CVE-2024-1417 Local Code Injection Vulnerability in AuthPoint Password Manager App for macOS Safari

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a adversary with local access to execute code under the context of the AuthPoint Password Manager application. This issue affects AuthPoint...

Zero-Day Alert: Apple Releases Patches for Actively Exploited Flaws in iOS, macOS, and Safari

Apple on Wednesday released a slew of updates for iOS, iPadOS, macOS, watchOS, and Safari browser to address a set of flaws it said were actively exploited in the wild. This includes a pair of zero-days that have been weaponized in a mobile surveillance campaign called Operation Triangulation tha...

CVE-2022-26716

A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4, Safari 15.5. Processing maliciously crafted web content may lead to arbitrary code execution...

CVE-2022-22629

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for Windows, iOS 15.4 and iPadOS 15.4, tvOS 15.4. Processing maliciously crafted web content may lead to arbitrary code execution...

JITSploitation I: A JIT Bug

By Samuel Groß, Project Zero This three-part series highlights the technical challenges involved in finding and exploiting JavaScript engine vulnerabilities in modern web browsers and evaluates current exploit mitigation technologies. The exploited vulnerability, CVE-2020-9802, was fixed in iOS...

Address bar spoofing on macOS Safari(CVE-2017-2500)

version: Safari function spoof document.write"Apple loginPlease input your Apple ID!!!But this is not apple.com!"; window.location.assign"http://www.apple.com:1234"; //or you can use the following JS code: //window.location.assign"http://access.apple.com"; setIntervalspoof,2000; setTimeoutfunctio...