CVE Vulnerability Catalog

An integer overflow vulnerability in macOS systems, fixed by improved input validation. An app may be able to cause unexpected system termination.

An out-of-bounds read vulnerability in macOS systems, fixed by improved bounds checking. Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory.

An out-of-bounds write vulnerability in macOS systems, fixed by improved bounds checking. Connecting to a malicious SMB server may lead to kernel memory corruption.

A vulnerability in macOS systems, fixed by additional entitlement checks. An app may be able to modify protected parts of the file system.

A privacy issue was addressed with improved private data redaction for log entries. A malicious application may be able to determine a user's current location.

A buffer overflow was addressed with improved bounds checking. Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory.

An out-of-bounds write issue was addressed with improved bounds checking. Processing a maliciously crafted asset catalog may lead to unexpected process termination.

A heap buffer overflow was addressed with improved bounds checking. Mounting a maliciously crafted volume may lead to unexpected system termination.

An out-of-bounds read was addressed with improved bounds checking. Connecting to a malicious SMB server may lead to unexpected system termination.

A race condition was addressed with improved state handling. An app may be able to cause unexpected system termination or corrupt kernel memory.

A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination or corrupt kernel memory.

An out-of-bounds write issue was addressed with improved bounds checking. Fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

A buffer overflow was addressed with improved size validation. Opening a maliciously crafted file may lead to unexpected process termination.

A race condition was addressed with improved state handling. An app may be able to cause unexpected system termination.

A permissions issue was addressed with additional restrictions. An app may be able to access sensitive user data.

A buffer overflow vulnerability in Apple systems, fixed with improved bounds checking. An app may cause a denial of service.

An integer overflow vulnerability in Apple systems, fixed with improved input validation. Processing a maliciously crafted file may disclose process memory.

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute output, and was rendered raw in the Containers dashboard list and editor views. A user with delegated access to the Page Containers dashboard could store a crafted icon value that broke out of the src attribute and executed script in the authenticated session of another editor or administrator who viewed the list, enabling session token theft and privileged dashboard actions. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.0 with vector CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks Andrew Gonzalez for reporting.

Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current version; blocks not aliased to another page or scrapbook entry were also removed from the global Blocks table and their block-type data table, permanently destroying the content. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.1 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API, and could set the header_extra_content attribute, which is rendered unescaped into the head element of every page, to persist JavaScript that executed in the browser of every visitor, including higher-privileged reviewers who approve the page version. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.2 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.