Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection

Summary AppInstaller post-stage-1 XPC listener accepts unvalidated connections, allowing spoofed appcast item data injection. Details Autoupdate/AppInstaller.m's shouldAcceptNewConnection: only enforces SUCodeSigningVerifier validateConnection: before stage 1 completes. After...

EUVD-2020-7492

Malware in sbrugna...

PT-2020-14461

Name of the Vulnerable Software and Affected Versions ASUS RT-AC1900P versions prior to 3.0.0.4.385 20253 Description An issue was discovered that allows XSS via spoofed Release Notes on the Firmware Upgrade page. Recommendations For versions prior to 3.0.0.4.385 20253, update to version...

CVE-2020-15499: Improper Neutralization of Input During Web Page Generation

An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.38520253. They allow XSS via spoofed Release Notes on the Firmware Upgrade page...