parallels-plist-escape

parallels-plist-escape 이 저장소에는 CVE-2023-27327 및 CVE-2023-27328에 대한 익스플로잇이 포함되어 있으며, 두 취약점을 함께 사용하여 Parallels Desktop 18.1.1 이전 버전의 Parallels Desktop 가상 머신에서 탈출할 수 있습니다. 또한 필수 커널 모듈의 코드가 prlmod에 포함되어 있으며, 이를 사용하여 /proc/driver/prltgpwn에 생성된 proc 항목을 통해 사용자 공간에서 임의의 Toolgate 요청 opcode 0x8000을 보낼 수...

CVE-2022-48565-POC

CVE-2022-48565 PoC はじめに これは、Pythonにおける Plistファイルの安全でないデシリアライゼーション に基づく脆弱性 CVE-2022-48565 を実証する Proof of Concept（PoC）です。特別に細工された Property List（Plist）ファイルを処理することで、攻撃者は対象システム上で任意のコードを実行でき、リモートコード実行（RCE） につながる可能性があります。...

osx-password-dumper

🍎 🔓 OSX 비밀번호 덤퍼 스크립트 개요 macOS 시스템에서 사용자의 .plist 파일을 검색하고, 그 안의 데이터를 크래킹 가능한 해시 형식으로 변환하는 Bash 스크립트입니다. John The Ripper 또는 Hashcat과 함께 사용 macOS 시스템에서의 CTF/침투 테스트/레드 팀 작업에 유용합니다. 사전 요구 사항 스크립트는 루트 사용자로 실행되어야 합니다 sudo macOS 환경 macOS VM Ventura beta 13.0 22A5266r에서 테스트됨 사용법 sudo ./osxpasswordcracker....

iOSForensic

iOSForensic iosForensic は、iOS のフォレンジック分析を支援する Python ツールです。 ファイルやログを取得し、sqlite3 データベースを抽出し、.plist ファイルを XML に展開します。 インストール この git リポジトリをクローンして依存関係をインストールするだけです。 依存関係 Linux OpenSSH sshpass sqlite3 python = 2.6 Python-magic plistutil デバイス 脱獄（ジェイルブレイク）済みのデバイス OpenSSH syslogd を /var/log/syslog...

CVE-2026-6666-XPC-Service-NSKeyedUnarchiver-Deserialization-Attack-macOS-iOS-simulation-

CVE-2026-6666 – XPC 服务 NSKeyedUnarchiver 反序列化攻击（macOS/iOS 模拟） 程序代码（Python 模拟） !/usr/bin/env python3 vulnerablexpcservice.py - Simulated XPC service using unsafe plist deserialization import plistlib, subprocess, socketserver, struct Mach message simulation: we just accept a binary plist over TCP...

Astra Linux – Vulnerabilities in Python 2.7, Python 3.7, and Pypy

A XXE issue was discovered in Python through version 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to prevent XML vulnerabilities...

Astra Linux – Vulnerability in Python 3.11, Python 3.7

When loading a plist file, the plistlib module reads data in a size specified by the file itself. This means that a malicious file can cause out-of-memory OOM and denial-of-service DoS issues...

Astra Linux – Vulnerability in Python 3.7

The readints function in plistlib.py in Python from version 3.9.1 is vulnerable to a potential Distributed Denial-of-Service DoS attack due to CPU and RAM exhaustion when processing malformed Apple Property List files in binary format...

K000163020: Plist vulnerability CVE-2022-22912

Security Advisory Description Prototype pollution vulnerability via .parse in Plist before v3.0.4 allows attackers to cause a Denial of Service DoS and may lead to remote code execution. CVE-2022-22912 Impact There is no impact; F5 products are not affected by this vulnerability. Security Advisor...

RLSA-2026:19177 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

cpython: Out-of-memory when loading Plist

A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RHEL 10 : python3.12 (RHSA-2026:19064)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19064 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

ALSA-2026:19064 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RLSA-2026:10950 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

RockyLinux 8 : python3.12 (RLSA-2026:10950)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:10950 advisory. expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing CVE-2025-59375...

cpython: Out-of-memory when loading Plist

A flaw was found in the plistlib module in the Python standard library. The amount of data to read from a Plist file is specified in the file itself. This issue allows a specially crafted Plist file to cause an application to allocate a large amount of memory, potentially resulting in allocations...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

ALSA-2026:10950 Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...