Karol Mazurek

Arduino IDE for macOS, before version 2.3.7, was installed with overly permissive file permissions on critical application components. This allowed any local user to replace legitimate files with malicious code. When another user launched the application, the malicious code would execute with their privileges, potentially leading to privilege escalation and unauthorized access to sensitive data.

Arduino IDE for macOS, before version 2.3.7, had overly permissive security entitlements. This configuration bypassed macOS Hardened Runtime protections, allowing attackers to inject malicious dynamic libraries into the application process. Successful exploitation granted attackers access to all Transparency, Consent, and Control (TCC) permissions assigned to the application.

An authentication bypass issue existed due to the application bundling a Python interpreter that inherited Transparency, Consent, and Control (TCC) permissions granted to the main application. Executing the bundled interpreter allowed attacker scripts to run with the application’s TCC privileges. The fix involves using parent-constraints to restrict interpreter launches to only the main application with those permissions.

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions prior to 5.0.175 Description: Invoice Ninja on macOS is susceptible to a local privilege escalation issue. The presence of the “com.apple.security.get-task-allow” entitlement allows local attackers with unprivileged access to attach a debugger, read or modify process memory, and inject code into the application's context, even with Hardened Runtime and Transparency, Consent, and Control (TCC) enabled. Access is limited to previously granted user permissions, but the entitlement bypasses a system authorization dialog normally required for debugging tools. Recommendations: Update to version 5.0.175 or later.

Name of the Vulnerable Software and Affected Versions: Mosh-Pro version 1.3.2 Description: The configuration of Mosh-Pro on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Mosh-Pro TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of Mosh-Pro, potentially disguising attacker's malicious intent. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Nozbe versions prior to 2025.11 Description: The configuration of Nozbe on macOS, specifically the "RunAsNode" fuse enabled, allows a local attacker with unprivileged access to execute arbitrary code that inherits Nozbe TCC (Transparency, Consent, and Control) permissions. Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission. Recommendations: Update Nozbe to version 2025.11 or later.

Name of the Vulnerable Software and Affected Versions: MacVim (affected versions not specified) Description: MacVim’s configuration on macOS, specifically the presence of the “com.apple.security.get-task-allow” entitlement, allows local attackers with unprivileged access to attach a debugger, read or modify process memory, and inject code into the application's context, even with Hardened Runtime and bypassing Transparency, Consent, and Control (TCC). Resource access is limited to previously granted user permissions; access beyond these requires user interaction with a system prompt. The absence of a prompt when the target process has the “get-task-allow” entitlement is considered a security issue as it removes a step needed to perform an attack. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GIMP versions prior to 3.1.4.2 Description: The MacOS version of GIMP includes a Python interpreter that inherits Transparency, Consent, and Control (TCC) permissions granted to the main application. An attacker with local access can use this interpreter to execute arbitrary commands or scripts, potentially accessing user files in privacy-protected folders without prompting the user for approval. Accessing resources beyond previously granted TCC permissions may prompt the user for approval under the guise of GIMP, potentially concealing malicious intent. Recommendations: Update to GIMP version 3.1.4.2 or later.

A flaw exists in the XPC services of Fantastical where proper client authorization checks were not implemented in the `listener:shouldAcceptNewConnection` method. This allowed any local, unprivileged process to connect to the XPC service and access its methods.

This is an arbitrary code execution issue that allows a locally authenticated attacker to execute arbitrary code. The issue has a high impact on confidentiality, integrity, and availability, and requires user interaction.

Name of the Vulnerable Software and Affected Versions: The Phoenix Code versions prior to the version with commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da Description: The issue is related to the configuration of The Phoenix Code on macOS, specifically the presence of certain entitlements. These entitlements allow for Dynamic Library (Dylib) injection, enabling a local attacker with unprivileged access to inject code into an application's context and bypass Transparency, Consent, and Control (TCC). The attacker can use environment variables like `DYLD INSERT LIBRARIES` to inject code. The acquired resource access is limited to previously granted permissions by the user, and access to other resources requires user interaction with a system prompt. Recommendations: For versions prior to the version with commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da, update to a version that includes the fix from commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da to resolve the issue. As a temporary workaround, consider restricting the use of environment variables like `DYLD INSERT LIBRARIES` to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Postbox versions (affected versions not specified) Description: The Postbox's configuration on macOS allows for Dynamic Library (Dylib) injection due to the presence of certain entitlements. A local attacker with unprivileged access can use environment variables like `DYLD INSERT LIBRARIES` to inject code in the application's context and bypass Transparency, Consent, and Control (TCC). The acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to the use of entitlement "com.apple.security.cs.disable-library-validation" and the lack of launch and library load constraints, allowing a local attacker with unprivileged access to substitute a legitimate dynamic library with a malicious one. This enables the attacker to bypass Transparency, Consent, and Control (TCC) and execute the application with altered dynamic library. The acquired resource access is limited to previously granted permissions by the user, and access to other resources beyond granted permissions requires user interaction with a system prompt asking for permission.

The issue allows loading a dynamic library with Viscosity's TCC identity on macOS systems by utilizing a Launch Agent and loading the viscosity openvpn process from the application bundle. The acquired resource access is limited without entitlements such as access to the camera or microphone. Only user-granted permissions for file resources apply. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.

The issue allows for HTML code injection into the page content through the `content` field in the Application definition page. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue allows an attacker with access to the Administration panel, specifically the "Role Management" tab, to inject code by adding a new role in the `name` field. However, the risk of exploiting this issue is reduced due to the required additional error that allows bypassing the Content-Security-Policy policy, which mitigates JS code execution while still allowing HTML injection.

The issue allows IP address spoofing by providing a custom value in the `X-Forwarded-For` header, which compromises the action logging mechanism's accountability.

The issue concerns code injection in the "modalDlgMsgInternal" parameter via POST in the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, which is then executed in the browser. The risk of exploitation is somewhat mitigated by the need to bypass the Content-Security-Policy.

The application does not limit the number or frequency of user interactions, such as the number of incoming requests. At the "/EPMUI/VfManager.asmx/ChangePassword" endpoint, it is possible to perform a brute force attack on the current password in use.

The issue is related to a path traversal vulnerability in the page cache module of the Hummingbird WordPress plugin. This vulnerability occurs because the plugin does not validate the generated file path for page cache files before writing them.