Apple Releases Urgent 0-Day Bug Patch for Mac, iPhone and iPad Devices

Apple on Monday rolled out an urgent security update for iOS, iPadOS, and macOS to address a zero-day flaw that it said may have been actively exploited, making it the thirteenth such vulnerability Apple has patched since the start of this year. The updates, which arrive less than a week after th...

Swift-Attack - Unit Tests For Blue Teams To Aid With Building Detections For Some Common macOS Post Exploitation Methods

Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods. I have included some post exploitation examples using both command line history and on disk binaries which should be easier for detection as well as post exploitation examples using API call...

Apple macOS Big Sur Input Validation Error Vulnerability

Apple macOS Big Sur is a mobile application app from Apple USA. The macOS Big Sur vulnerability is an input validation error vulnerability that arises from a failure to adequately validate user-supplied input within the TCC subsystem, which could allow a malicious application to bypass privacy...

Apple Patches Zero-Day Flaw in MacOS that Allows for Sneaky Screenshots

Apple has patched a critical bug in macOS that could be exploited to take screenshots of someone’s computer and capture images of their activity within applications or on video conferences without that person knowing. Apple addressed the vulnerability—discovered by researchers at enterprise...

Apple macOS 输入验证错误漏洞

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. An input validation error vulnerability exists in the TCC component of Apple macOS, which stems from improper privilege management in TCC. A native application can send unauthorized Apple events to the Finder...

Apple Tcc Authorization Issues Vulnerabilities

Apple Tcc is a database used by Apple Inc. in the United States to store privacy and security-related settings in System Preferences. Apple Tcc is vulnerable to an authorization issue and the following products and versions are affected: iMac 2014 and later, MacBook 2015 and later, iMac Pro all...

CVE-2020-9934 - macOS Transparency, Consent, and Control (TCC) Framework bypass

An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6. A local user may be able to view sensitive user information. Recent assessments: busterb at August 03, 2020 10:42p...

Metasploit Wrap-Up

Refreshingly configurable F5, on top of being a handy shortcut you can press over and over again until 3am just to watch the RTX 3080 preorders sell out instantly, is also a company that specializes in the delivery, security, performance, and availability of web applications, computing, storage,...

Bypass the macOS TCC Framework

This module exploits a vulnerability in the TCC daemon on macOS Catalina use post/osx/escalate/tccbypass msf posttccbypass show actions ...actions... msf posttccbypass set ACTION msf posttccbypass show options ...show and set options... msf posttccbypass run This module requires Metasploit:...

Apple macOS Catalina TCC Component Logic Issue Vulnerability

Apple macOS Catalina is a specialized operating system developed by Apple Inc. for Mac computers. A logic problem exists in the Apple macOS Catalina TCC component, which can be exploited by attackers to create malicious applications that may be able to bypass code signing implementations...

tcc-sport.com Cross Site Scripting vulnerability

Security Researcher badmaxx Helped patch 1670 vulnerabilities Received 5 Coordinated Disclosure badges Received 5 recommendations , a holder of 5 badges for responsible and coordinated disclosure, found a security vulnerability affecting tcc-sport.com website and its users. Following coordinated...

CVE-2019-12495

An issue was discovered in Tiny C Compiler aka TinyCC or TCC 0.9.27. Compiling a crafted source file leads to a one-byte out-of-bounds write in the gsymaddr function in x8664-gen.c. This occurs because tccasm.c mishandles section switches...

CVE-2019-12495

CVE-2019-12495 affects Tiny C Compiler (TinyCC/TCC) 0.9.27. A crafted source file can trigger a one-byte out-of-bounds write in gsym_addr in x86_64-gen.c due to tccasm.c mishandling section switches. This was reported across multiple sources (NVD entry and Red Hat advisory) and is described as a ...

CVE-2019-9754

The CVE-2019-9754 issue affects Tiny C Compiler (TinyCC/TCC) 0.9.27. An attacker-supplied crafted source file can trigger a 1-byte out-of-bounds write in the end_macro function of tccpp.c. The connected sources consistently describe this exact flaw; no additional technical details (e.g., affected...

CVE-2018-20375

An issue was discovered in Tiny C Compiler aka TinyCC or TCC 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the sympop function in tccgen.c...

CVE-2018-20376

An issue was discovered in Tiny C Compiler aka TinyCC or TCC 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the asmparsedirective function in tccasm.c...

Out-of-bounds

An issue was discovered in Tiny C Compiler aka TinyCC or TCC 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the usesection1 function in tccasm.c...

CVE-2018-20374

CVE-2018-20374 affects Tiny C Compiler (TinyCC, TCC) version 0.9.27. The issue is an 8-byte out-of-bounds write in the use_section1 function in tccasm.c when compiling a crafted source file. The connected documents do not specify a patch or remediation, nor additional vulnerable variants beyond 0...

CVE-2018-20376

An issue was discovered in Tiny C Compiler aka TinyCC or TCC 0.9.27. Compiling a crafted source file leads to an 8 byte out of bounds write in the asmparsedirective function in tccasm.c...

CVE-2018-20376

CVE-2018-20376 affects Tiny C Compiler (TinyCC) 0.9.27. The vulnerability is an 8-byte out-of-bounds write in the asm_parse_directive function in tccasm.c when compiling a crafted source file. The connected documents consistently describe this exact flaw and file path, without additional exploit ...