SUSE CVE-2009-2471

The setTimeout function in Mozilla Firefox before 3.0.12 does not properly preserve object wrapping, which allows remote attackers to execute arbitrary JavaScript with chrome privileges via a crafted call, related to XPCNativeWrapper...

SUSE CVE-2010-2763

The XPCSafeJSObjectWrapper class in the SafeJSObjectWrapper aka SJOW implementation in Mozilla Firefox before 3.5.12, Thunderbird before 3.0.7, and SeaMonkey before 2.0.7 does not properly restrict scripted functions, which allows remote attackers to bypass the Same Origin Policy and conduct...

The vulnerability of the LaunchServices service in Mac OS operating systems allows attackers to circumvent security restrictions and increase their privileges.

The vulnerability of the LaunchServices service in Mac OS operating systems is related to deficiencies in access control when processing XPC messages. Exploiting this vulnerability can allow attackers to circumvent security restrictions and enhance their privileges...

Apple macOS LaunchServices Sandbox Escape Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escape the sandbox on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of XPC...

CVE-2022-22676

An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission...

CVE-2022-22676

An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission...

CVE-2022-22676

An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission...

Input validation

An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission...

CVE-2022-22676

An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission...

CVE-2022-22676

CVE-2022-22676 describes an event handler validation issue in the XPC Services API. The vulnerability was addressed by removing the vulnerable service, and is fixed in macOS Monterey 12.2. The impact is that an application may be able to delete files for which it does not have permission. Remedia...

Apple OS X Authentication Bypass Vulnerability

The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and obtain admin privileges...

PT-2022-15623 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.2 Description: An event handler validation issue in the XPC Services API was addressed by removing the service. This issue may allow an application to delete files for which it does not have permission...

CVE-2021-41388

Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low privileged user can connect and call external methods...

Privilege escalation

Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low privileged user can connect and call external methods...

CVE-2021-41388

Netskope client prior to 89.x on macOS is impacted by a local privilege escalation vulnerability. The XPC implementation of nsAuxiliarySvc process does not perform validation on new connections before accepting the connection. Thus any low privileged user can connect and call external methods...

CVE-2021-41388

Affected product: Netskope client for macOS (pre-89.x). Vulnerable component: XPC implementation of nsAuxiliarySvc. Root cause: new connections are not validated before acceptance, enabling a low-privileged user to call external methods as root. Impact: local privilege escalation to highest level...

CVE-2020-15495

Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration...

CVE-2020-25736

Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration...

CVE-2020-15495

Acronis True Image 2019 update 1 through 2020 on macOS allows local privilege escalation due to an insecure XPC service configuration...

CVE-2020-25736

Acronis True Image 2019 update 1 through 2021 update 1 on macOS allows local privilege escalation due to an insecure XPC service configuration...