Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS prior to version 17 and iPadOS prior to version 17, which stems from a...

CVE-2025-30281

ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary file system read. An attacker could leverage this vulnerability to access or modify sensitive data without proper authorization. Exploitation of this...

CVE-2025-30281

CVE-2025-30281 affects Adobe ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier. The vulnerability is an Improper Access Control that could allow a high-privilege, remote attacker to access or modify sensitive data and potentially execute arbitrary code without user interaction. The issue’s...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges and gain access to sensitive data. The vulnerability with reference CVE-2025-27489 allows the malicious party, by loading a non-Microsoft DLL...

CVE-2025-27437

CVE-2025-27437 affects SAP NetWeaver Application Server ABAP, specifically the Virus Scanner Interface. The vulnerability is a missing authorization check that allows an attacker authenticated as a non-administrative user to initiate a transaction and access but not modify non-sensitive data, wit...

CVE-2025-27437 Missing Authorization check in SAP NetWeaver Application Server ABAP (Virus Scan Interface)

A Missing Authorization Check vulnerability exists in the Virus Scanner Interface of SAP NetWeaver Application Server ABAP. Because of this, an attacker authenticated as a non-administrative user can initiate a transaction, allowing them to access but not modify non-sensitive data without further...

CVE-2025-24202

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access sensitive user data...

CVE-2025-1659

A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process...

CVE-2025-30450

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access sensitive user data...

CVE-2025-30447

The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data...

CVE-2025-30450

CVE-2025-30450 concerns macOS where improved validation of symlinks mitigates a data exposure risk. The issue affects macOS Ventura, Sequoia, and Sonoma—specifically Ventura 13.7.5, Sequoia 15.4, and Sonoma 14.7.5 contain the fix. The underlying vulnerability allows an app to potentially access s...

CVE-2025-31191

CVE-2025-31191 is a macOS sandbox escape vulnerability fixed in Apple security updates (Ventura 13.7.5, Sequoia 15.4, Sonoma 14.7.5, iOS 18.4, etc.). The connected Microsoft threat research details a sandbox-escape chain abusing security-scoped bookmarks and the keychain. Attackers could leverage...

CVE-2025-31191

This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, watchOS 11.4. An app may be able to access sensitive user data...

CVE-2025-24214

A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to access sensitive user data...

CVE-2025-24205

The CVE-2025-24205 entry concerns an authorization issue in Apple platforms that could let an app access user-sensitive data. The connected sources confirm affected products and versions and provide remediation details: macOS Ventura 13.7.5; iOS 18.4 and iPadOS 18.4; iPadOS 17.7.6; macOS Sequoia ...

CVE-2025-24246

CVE-2025-24246 affects macOS, with an injection issue addressed by improved input validation. The vulnerability is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, and macOS Sonoma 14.7.5. The advisory states that an app could access user‑sensitive data, but the exact root cause is described ge...

CVE-2025-30443

CVE-2025-30443 is a privacy issue detected in macOS components where user-sensitive data could be exposed. The Apple advisory indicates the root cause was removal of vulnerable code, with fixes rolled out in macOS updates: Ventura 13.7.5, Sequoia 15.4, and Sonoma 14.7.5 (per initial description)....

CVE-2025-24240

CVE-2025-24240 describes a race condition in macOS that could let an app access user-sensitive data. The issue is fixed in macOS updates: Ventura 13.7.5, Sequoia 15.4, and Sonoma 14.7.5. Affected component: the operating system’s handling that allowed local access to sensitive data under a race c...

Unsolved Challenge: Why API Access Control Vulnerabilities Remain a Major Security Risk

Despite advancements in API security, access control vulnerabilities, such as broken object-level authentication BOLA and broken function-level authentication BFLA, remain almost impossible to detect. This blog will explore why these vulnerabilities are so difficult to detect, the limitations of...

PT-2025-13970 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.4 Description: The issue allows a sandboxed app to potentially access sensitive user data in system logs. This is due to inadequate redaction of sensitive information. The estimated number of potentially affected...