CVE-2025-24226: Exposure of Sensitive Information to an Unauthorized Actor

The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information...

PT-2025-13914 · Apple · Macos Sonoma +3

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.5 macOS Sequoia versions prior to 15.4 macOS Sonoma versions prior to 14.7.5 Description: A malicious app may be able to access arbitrary files due to an issue that was addressed through improved state...

CVE-2024-54560

A logic issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, watchOS 11, tvOS 18, macOS Sequoia 15. A malicious app may be able to modify other apps without having App Management permission...

CVE-2024-54560

CVE-2024-54560 is a logic issue addressed by Apple across multiple platforms. According to connected sources, the vulnerability could allow a malicious application to modify other apps without the App Management permission. The fix is included in macOS Sequoia 15, iOS 18, iPadOS 18, watchOS 11, a...

The Trump Administration Is Deprioritizing Russia as a Cyber Threat

Plus: The FBI pins that ByBit theft on North Korea, a malicious app download breaches Disney, spyware targets a priest close to the pope, and more...

Predatory app downloaded 100,000 times from Google Play Store steals data, uses it for blackmail

A malicious app claiming to be a financial management tool has been downloaded 100,000 times from the Google Play Store. The app— known as “Finance Simplified”—belongs to the SpyLoan family which specializes in predatory lending. Sometimes malware creators manage to get their apps listed in the...

No need to RSVP: a closer look at the Tria stealer campaign

Introduction Since mid-2024, we've observed a malicious Android campaign leveraging wedding invitations as a lure to social-engineer victims into installing a malicious Android app APK, which we have named "Tria Stealer" after unique strings found in campaign samples. The primary targets of the...

CVE-2025-24107

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.3, tvOS 18.3, watchOS 11.3, iOS 18.3 and iPadOS 18.3. A malicious app may be able to gain root privileges...

CVE-2025-24136

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. A malicious app may be able to create symlinks to protected regions of the disk...

CVE-2025-24096: Missing Authorization

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. A malicious app may be able to access arbitrary files...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for the iPad tablet computer. A security vulnerability exists in Apple iOS version 18.3 and Apple iPadOS version 18.3, which originates from...

PT-2025-5284 · Apple · Ipados +4

Name of the Vulnerable Software and Affected Versions: macOS Sequoia versions prior to 15.3 tvOS versions prior to 18.3 watchOS versions prior to 11.3 iOS versions prior to 18.3 iPadOS versions prior to 18.3 Description: A permissions issue was addressed with additional restrictions. A malicious...

CVE-2024-49733

In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-49733

Google Android is affected by an information disclosure vulnerability caused by a logic error in the code within ServiceListing.java . A malicious application could exploit this to hide an NLS from Settings , leading to local information disclosure without requiring additional execution privilege...

CVE-2024-49733

In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-49733

In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-49733: Exposure of Sensitive Information to an Unauthorized Actor

In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2025-2848

Name of the Vulnerable Software and Affected Versions No specific software name or versions are mentioned in the provided descriptions. Description A logic error in the code of ServiceListing.java allows a malicious app to potentially hide an NLS from Settings, leading to local information...

ASB-A-365738306

In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-42220

A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make u...