15 matches found
MAL-2026-11648 Malicious code in @onereach/si-textinput (npm)
npm/@onereach/si-textinput is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
PT-2024-39707
Name of the Vulnerable Software and Affected Versions Category and Taxonomy Meta Fields plugin for WordPress version 1.0.0 Description The issue is related to Stored Cross-Site Scripting via the image meta field value in the wpaft add meta textinput function due to insufficient input sanitization...
iOS Mac OS X Code Execution
The vulnerability of the TextInput component in the iOS operating system arises from the execution of an operation outside the buffer in memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a service failure memory corruption, application termination with...
Apple macOSiOS - TIKeyboardLayout initWithCoder: NSKeyedArchiver Heap Corruption Due to Rounding Error
Apple macOSiOS - TIKeyboardLayout initWithCoder: NSKeyedArchiver Heap Corruption Due to Rounding Error Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1172 Using lldb inside a simple helloworld app for iOS we can see that there are over 600 classes which we could get deserialize...
Apple macOS/iOS - 'TIKeyboardLayout initWithCoder:' NSKeyedArchiver Heap Corruption Due to Rounding Error
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1172 Using lldb inside a simple helloworld app for iOS we can see that there are over 600 classes which we could get deserialized for persistance for example. The TextInput framework which is loaded has a class TIKeyboardLayout. Th...
CVE-2017-2524
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "TextInput" component. It allows remote attackers to execute arbitrary code or cause a denia...
CVE-2017-2524: Improper Restriction of Operations within the Bounds of a Memory Buffer
An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the "TextInput" component. It allows remote attackers to execute arbitrary code or cause a denia...
PT-2017-2278
Name of the Vulnerable Software and Affected Versions iOS versions prior to 10.3.2 macOS versions prior to 10.12.5 tvOS versions prior to 10.2.1 watchOS versions prior to 3.2.2 Description The issue involves the TextInput component and is caused by a buffer overflow in memory. It allows remote...
Apple TV < 10.2.1 Multiple Vulnerabilities
Binary data 700118.prm...
Apple iOS < 10.3.2 Multiple Vulnerabilities
Binary data appleios1032check.nbin...
Mac OS X Multiple Vulnerabilities (Security Update 2017-002)
The remote host is running a version of Mac OS X 10.10.5 or 10.11.6 that is missing a security update. It is therefore, affected by multiple vulnerabilities : - A memory corruption issue exists in the Sandbox component that allows an unauthenticated, remote attacker to escape an application...
macOS 10.12.x < 10.12.5 Multiple Vulnerabilities
The remote host is running a version of macOS that is 10.12.x prior to 10.12.5. It is, therefore, affected by multiple vulnerabilities : - Multiple memory corruption issues exist in the Kernel component that allow a local attacker to gain kernel-level privileges. CVE-2017-2494, CVE-2017-2546 - A...
Mac OS X 10.x < 10.12.5 Multiple Vulnerabilities
Binary data 700119.prm...
Apple iOS < 10.3.2 Multiple Vulnerabilities
Binary data 700116.prm...
Apple TV < 10.2.1 Multiple Vulnerabilities
According to its banner, the version of Apple TV on the remote device is prior to 10.2.1. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists in the WebKit Web Inspector component that allows an unauthenticated, remote attacker to execute arbitrary code...