Sean Seah

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross-Process Communication (XPC) while masquerading as an Apple-signed process.

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended.

A flaw exists in CyberArk Secure Web Sessions Extension on Chrome and Edge that could lead to a denial of service when initiating new Secure Web Sessions (SWS) sessions. The issue is due to improper input validation.