CVE-2024-43106

A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of...

CVE-2024-42220

A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS. A specially crafted library can leverage Outlook's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make u...

CVE-2024-42004

Cisco Talos and related sources document a library-injection vulnerability (CVE-2024-42004) affecting Microsoft Teams for macOS 24046.2813.2770.1094, where specially crafted libraries loaded via relative paths and insufficient library-validation entitlements (com.apple.security.cs.disable-library...

CVE-2024-42004

A library injection vulnerability exists in Microsoft Teams work or school 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this...

CVE-2024-41165

A library injection vulnerability exists in Microsoft Word 16.83 for macOS. A specially crafted library can leverage Word's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of th...

CVE-2024-41165

CVE-2024-41165 affects Microsoft Word 16.83 for macOS. Talos reports a library-injection vulnerability where a malicious library loaded via relative paths and the app’s hardened runtime with com.apple.security.cs.disable-library-validation enabled could be used to bypass permissions and reuse Wor...

CVE-2024-41159

A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use...

CVE-2024-41159

Microsoft OneNote for macOS CVE-2024-41159 is a library-injection vulnerability where a malicious library loaded via relative paths can leverage OneNote’s entitlements and permissions to bypass protections. Talos documents show OneNote loads libraries through relative paths and, despite Hardened ...

CVE-2024-39804

CVE-2024-39804 concerns Microsoft PowerPoint 16.83 on macOS. Talos/Cisco documents describe a library-injection vulnerability enabled by libraries loaded via relative paths and the hardened runtime with the entitlement com.apple.security.cs.disable-library-validation set to true. An attacker coul...

CVE-2024-39804

A library injection vulnerability exists in Microsoft PowerPoint 16.83 for macOS. A specially crafted library can leverage PowerPoint's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then ma...

CVE-2024-54491

The issue was resolved by sanitizing logging This issue is fixed in macOS Sequoia 15.2. A malicious application may be able to determine a user's current location...

CVE-2024-54471

This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to leak a user's credentials...

CVE-2024-54491

CVE-2024-54491 : macOS Sequoia 15.2 fixes a location-privacy issue in logging. The vulnerability allowed a malicious application to determine a user’s current location via logging data. The issue is resolved by sanitizing log output. Affected product/versions and remediation are limited to what i...

Fake Recruiters Distribute Banking Trojan via Malicious Apps in Phishing Scam

Cybersecurity researchers have shed light on a sophisticated mobile phishing aka mishing campaign that's designed to distribute an updated version of the Antidot banking trojan. "The attackers presented themselves as recruiters, luring unsuspecting victims with job offers," Zimperium zLabs Vishnu...

CVE-2024-11136

The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious URI path and delete arbitrary files from user’s external storage...

CVE-2024-11136

The CVE-2024-11136 entry concerns the default TCL Camera application, which exposes a provider vulnerable to path traversal. A malicious app can supply a crafted URI path through this provider to delete arbitrary files on the user’s external storage. The vulnerability is rooted in the provider’s ...

CVE-2024-44287

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious application may be able to modify protected parts of the file system...

CVE-2024-44301

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to modify protected parts of the file system...

CVE-2024-44267

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious application may be able to modify protected parts of the file system...

CVE-2024-44275

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. A malicious application may be able to modify protected parts of the file system...