1710 matches found
CVE-2025-24205
The CVE-2025-24205 entry concerns an authorization issue in Apple platforms that could let an app access user-sensitive data. The connected sources confirm affected products and versions and provide remediation details: macOS Ventura 13.7.5; iOS 18.4 and iPadOS 18.4; iPadOS 17.7.6; macOS Sequoia ...
CVE-2025-24246
CVE-2025-24246 affects macOS, with an injection issue addressed by improved input validation. The vulnerability is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. The advisory states that an app could access user‑sensitive data, but the exact root cause is described ge...
CVE-2025-30443
CVE-2025-30443 is a privacy issue detected in macOS components where user-sensitive data could be exposed. The Apple advisory indicates the root cause was removal of vulnerable code, with fixes rolled out in macOS updates: Ventura 13.7.5, Sequoia 15.4, and Sonoma 14.7.5 (per initial description)....
CVE-2025-24240
CVE-2025-24240 describes a race condition in macOS that could let an app access user-sensitive data. The issue is fixed in macOS updates: Ventura 13.7.5, Sequoia 15.4, and Sonoma 14.7.5. Affected component: the operating system’s handling that allowed local access to sensitive data under a race c...
Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk
Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication BOLA and broken function-level authentication BFLA, remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of...
PT-2025-13970 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.4 Description: The issue allows a sandboxed app to potentially access sensitive user data in system logs. This is due to inadequate redaction of sensitive information. The estimated number of potentially affected...
Apple macOS 安全漏洞
Apple macOS is a suite of specialized operating systems from the U.S.-based Apple Inc. developed specifically for Mac computers. A security vulnerability exists in Apple macOS Sequoia, which stems from insufficient sandboxing restrictions and could lead to applications accessing sensitive user da...
PT-2025-13918 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.4 macOS versions prior to 14.7.5 Description: An access issue was addressed with additional sandbox restrictions. This issue allows an app to potentially access sensitive user data. Recommendations: For macOS versio...
Apple iOS和Apple iPadOS 信息泄露漏洞
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and Apple iPadOS, which arises from the possibility that applications may...
Apple iOS和Apple iPadOS 信息泄露漏洞
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and Apple iPadOS, which stems from the fact that applications may be able to...
PT-2025-13981 · Apple · Apple Macos
Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.4 Description: The issue allows an app to potentially access sensitive user data due to inadequate redaction of sensitive information. This issue was addressed with improved redaction of sensitive information...
PT-2025-13591 · Onenav · Onenav
Name of the Vulnerable Software and Affected Versions: OneNav version 1.1.0 Description: The issue is related to Server-Side Request Forgery SSRF in custom headers. This means an attacker could potentially force the server to make requests to arbitrary domains, which could lead to unauthorized...
Mozilla Firefox Security Update (MFSA2025-19) - Windows
Mozilla Firefox is prone to a sandbox escape vulnerability SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...
CVE-2025-30367 WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information...
CVE-2025-2332
CVE-2025-2332 affects the WordPress plugin Export All Posts, Products, Orders, Refunds & Users. It allows unauthenticated PHP Object Injection via deserialization in returnMetaValueAsCustomerInput, with impact only if a POP chain exists in a second plugin/theme. Affected versions go up to 2.13; p...
Remote code execution vulnerability in Ingress NGINX Controller (CNVD-2025-05884)
Ingress NGINX Controller is an open source portal controller that uses NGINX as a reverse proxy and load balancer. Ingress NGINX Controller suffers from a remote code execution vulnerability that can be exploited by an attacker to gain access to sensitive data such as credentials and keys across...
Frappe has possibility of SQL injection due to improper validations
Impact An SQL Injection vulnerability has been identified in Frappe Framework which could allow a malicious actor to access sensitive information. Workarounds Upgrading is required, no other workaround is present. Credits Thanks to Thanh of Calif.io for reporting the issue...
CVE-2024-10513
A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the...
CVE-2025-26816
A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular permissions under certain conditions to see potentially sensitive data from a different user context...
