Aggregator

CVE-2024-54547 | Apple macOS up to 13.6/14.6/15.1 access control (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability marked as critical has been reported in Apple macOS up to 13.6/14.6/15.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper access controls. This vulnerability is listed as CVE-2024-54547. The attack must be carried out locally. There is no available exploit. It is suggested to upgrade the affected component.
vuldb.com

CVE-2024-54542 | Apple iOS/iPadOS up to 11.1/15.1/18.1 State Management improper authentication (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability has been found in Apple iOS and iPadOS up to 11.1/15.1/18.1 and classified as critical. This vulnerability affects unknown code of the component State Management Handler. The manipulation leads to improper authentication. This vulnerability is documented as CVE-2024-54542. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.
vuldb.com

CVE-2024-54542 | Apple Safari up to 11.1/15.1/18.1 State Management improper authentication (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability was found in Apple Safari up to 11.1/15.1/18.1 and classified as critical. This issue affects some unknown processing of the component State Management Handler. The manipulation results in improper authentication. This vulnerability is reported as CVE-2024-54542. The attack requires a local approach. No exploit exists. It is suggested to upgrade the affected component.
vuldb.com

CVE-2024-54542 | Apple watchOS up to 11.1/15.1/18.1 State Management improper authentication (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability, which was classified as critical, was found in Apple watchOS up to 11.1/15.1/18.1. This affects an unknown part of the component State Management Handler. Executing manipulation can lead to improper authentication. This vulnerability is registered as CVE-2024-54542. The attack needs to be launched locally. No exploit is available. You should upgrade the affected component.
vuldb.com

Wrap Up: The Month of AI Bugs

Embrace The Red
5 months 3 weeks ago

That’s it.

The Month of AI Bugs is done. There won’t be a post tomorrow, because I will be at PAX West.

Overview of Posts
  1. ChatGPT: Exfiltrating Your Chat History and Memories With Prompt Injection | Video
  2. ChatGPT Codex: Turning ChatGPT Codex Into a ZombAI Agent | Video
  3. Anthropic Filesystem MCP Server: Directory Access Bypass Via Improper Path Validation | Video
  4. Cursor: Arbitrary Data Exfiltration via Mermaid | Video
  5. Amp Code: Arbitrary Command Execution via Prompt Injection | Video
  6. Devin AI: I Spent $500 To Test Devin For Prompt Injection So That You Don’t Have To
  7. Devin AI: How Devin AI Can Leak Your Secrets via Multiple Means
  8. Devin AI: The AI Kill Chain in Action: Exposing Ports to the Internet via Prompt Injection
  9. OpenHands - The Lethal Trifecta Strikes Again: How Prompt Injection Can Leak Access Tokens
  10. OpenHands: Remote Code Execution and AI ClickFix Demo | Video
  11. Claude Code: Data Exfiltration with DNS Requests (CVE-2025-55284) | Video
  12. GitHub Copilot: Remote Code Execution (CVE-2025-53773) | Video
  13. Google Jules: Vulnerable to Multiple Data Exfiltration Issues
  14. Google Jules - Zombie Agent: From Prompt Injection to Remote Control
  15. Google Jules: Vulnerable To Invisible Prompt Injection
  16. Amp Code: Invisible Prompt Injection Vulnerability Fixed
  17. Amp Code: Data Exfiltration via Image Rendering Fixed | Video
  18. Amazon Q Developer: Secrets Leaked via DNS and Prompt Injection | Video
  19. Amazon Q Developer: Remote Code Execution via Prompt Injection | Video
  20. Amazon Q Developer: Vulnerable to Invisible Prompt Injection | Video
  21. Windsurf: Hijacking Windsurf: How Prompt Injection Leaks Developer Secrets | Video
  22. Windsurf: Memory-Persistent Data Exfiltration - SpAIware Exploit
  23. Windsurf: Sneaking Invisible Instructions by Developers
  24. Deep Research Agents: How Deep Research Agents Can Leak Your Data
  25. Manus: How Prompt Injection Hijacks Manus to Expose VS Code Server to the Internet | Video
  26. AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection | Video
  27. Cline: Vulnerable to Data Exfiltration and How to Protect Your Data | Video
  28. Windsurf MCP Integration: Missing Security Controls Put Users at Risk | Video
  29. Season Finale: AgentHopper: An AI Virus Research Project Demonstration | Video

Thank you for following this research, and I hope it serves as a useful reference.

Does it possible?

不安全
5 months 3 weeks ago
这是一个面向新手和资深人士的黑客社区，旨在帮助成员提升地下技能。用户可以提问、解答和学习，并通过Discord进一步交流。

CVE-2024-54542 | Apple macOS up to 11.1/15.1/18.1 State Management improper authentication (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability, which was classified as critical, has been found in Apple macOS up to 11.1/15.1/18.1. Affected by this issue is some unknown functionality of the component State Management Handler. Performing manipulation results in improper authentication. This vulnerability is cataloged as CVE-2024-54542. The attack must be initiated from a local position. There is no exploit available. It is advisable to upgrade the affected component.
vuldb.com

CVE-2024-54539 | Apple macOS up to 13.6/14.6/15.1 Keyboard Event state issue (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability, which was classified as problematic, was found in Apple macOS up to 13.6/14.6/15.1. This impacts an unknown function of the component Keyboard Event Handler. Executing manipulation can lead to state issue. The identification of this vulnerability is CVE-2024-54539. The attack can only be executed locally. There is no exploit available. You should upgrade the affected component.
vuldb.com

CVE-2024-54536 | Apple macOS up to 15.1 NVRAM Variable access control (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability labeled as critical has been found in Apple macOS up to 15.1. Affected is an unknown function of the component NVRAM Variable Handler. Executing manipulation can lead to improper access controls. This vulnerability is tracked as CVE-2024-54536. The attack is restricted to local execution. No exploit exists. The affected component should be upgraded.
vuldb.com

CVE-2024-54531 | Apple macOS up to 15.1 kASLR memory corruption (WID-SEC-2024-3692)

Vuldb Updates
5 months 3 weeks ago
A vulnerability identified as critical has been detected in Apple macOS up to 15.1. The affected element is an unknown function of the component kASLR. Performing manipulation results in memory corruption. This vulnerability is cataloged as CVE-2024-54531. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.
vuldb.com

Qilin

Dark Feed IO
5 months 3 weeks ago

You must login to view this content

cohenido

Qilin

Dark Feed IO
5 months 3 weeks ago

You must login to view this content

cohenido

Managed ad