CVE Vulnerability Catalog

The issue was addressed through improved state management. The issue affects macOS Golden Gate 27. An app may be able to access sensitive user data.

The issue was addressed with improved memory handling. The issue affects iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, and watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory.

A buffer overflow was addressed with improved bounds checking. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7. Mounting a malicious disk image may cause unexpected system termination.

A use-after-free issue was addressed with improved memory management. The issue affects macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, and macOS Tahoe 26.6. An app may be able to cause unexpected system termination.

A logic issue in macOS allows an application to bypass Gatekeeper checks. The flaw was addressed with improved checks and is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.6/26.7.

A correctness issue in macOS Sonoma allows an attacker with physical access to silently persist an Apple Account on an erased device. The issue is fixed in macOS Sonoma 14.8.8.

An authentication issue in Apple systems allows an app to use the Sign In With Apple flow to access the user's Apple Account. It was addressed with improved state management in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and visionOS 27.

IBM Sterling File Gateway versions 6.2.0.0 through 6.2.0.6_1, 6.2.1.0 through 6.2.1.2, and 6.2.2.0 through 6.2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker could leverage this to terminate their own process.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in certain versions could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a buffer overflow in a PASE process that can lead to denial of service. An authenticated attacker could leverage this to terminate their own process.

IBM i versions 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain ownership of arbitrary file system objects due to a time-of-check to time-of-use (TOCTOU) race condition.

IBM i Access Family versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a session file.

IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a malicious emulator macro RunProgram action.

IBM i Access Client Solutions (part of IBM i Access Family) versions 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges. This is caused by improper validation of user-supplied input in a STRPCCMD CL command.

IBM MQ versions LTS and CD up to 10.0.0.0 allow a remote authenticated attacker to execute arbitrary code on the system due to deserialization of untrusted data.

IBM MQ versions LTS and CD up to 10.0.0.0 are vulnerable to XML External Entity (XXE) attacks when processing XML data, potentially exposing sensitive information or consuming memory resources.

IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

IBM Verify Identity Access allows a remote attacker to conduct phishing attacks via an open redirect. By luring a victim to a crafted website, the attacker can spoof the displayed URL and redirect the user to a malicious site that appears trusted.

This entry covers IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the corresponding container versions. The description does not include technical details of the vulnerability.