Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-5940 State: PUBLISHED Published: 2025-06-27T07:22:22.816Z Last Updated: 2025-06-27T13:50:10.976Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: osompress Products: Osom Blocks – Custom Post Type listing block Problem Types: CWE-79 Description: The Osom Blocks – Custom Post Type listing block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class_name’ parameter in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute wh
icated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/54e022df-0dc7-4f60-811d-48a92b723d55?source=cve - https://plugins.trac.wordpress.org/browser/osomblocks/trunk/blocks/cpt-list/index.php#L171 - https://wordpress.org/plugins/osomblocks/#developers
CVE ID: CVE-2025-5941 State: PUBLISHED Published: 2025-08-14T04:34:43.106Z Last Updated: 2025-08-15T12:58:34.161Z Vendors: Netskope Products: Netskope Client Problem Types: CWE-125 Description: Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a machine. A successful exploitation may require administrative privileges on the machine, based on the exact configuration. A successful exploit can potentially result in user-controllable memory being leaked in a domain name stored on the local machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netskope.com/co
tored on the local machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-001
CVE ID: CVE-2025-5942 State: PUBLISHED Published: 2025-08-14T04:36:05.383Z Last Updated: 2025-08-18T16:45:47.540Z Vendors: Netskope Products: Netskope Client Problem Types: CWE-122 Description: Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, an unprivileged user can trigger a heap overflow in the epdlpdrv.sys driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation can also potentially be performed by an unprivileged user whose NS Client is configured to use Endpoint DLP. A successful exploit can result in a denial-of-service for the local machine. Additional Analyst Notes: - CISA ADP Vulnrichmen
essful exploit can result in a denial-of-service for the local machine. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-003
CVE ID: CVE-2025-5943 State: PUBLISHED Published: 2025-06-10T17:42:33.029Z Last Updated: 2025-06-11T14:39:58.540Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MicroDicom Products: DICOM Viewer Problem Types: CWE-787 Description: MicroDicom DICOM Viewer suffers from an out-of-bounds write vulnerability. Remote attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit the vulnerability in that the user must either visit a malicious website or open a malicious DICOM file locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ci
or open a malicious DICOM file locally. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-160-01
CVE ID: CVE-2025-5944 State: PUBLISHED Published: 2025-07-03T04:25:01.278Z Last Updated: 2025-07-03T13:17:43.130Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Element Pack Elementor Addons and Templates Problem Types: CWE-79 Description: The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-caption’ attribute in all versions up to, and including, 8.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a us
ckers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ee6b1497-ffac-4eb3-baad-36270e419a95?source=cve - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/assets/js/bdt-uikit.js - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/lightbox/widgets/lightbox.php - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/custom-gallery/widgets/custom-gallery.php - https://plugins.trac.wordpress.o
er/bdthemes-element-pack-lite/trunk/modules/custom-gallery/widgets/custom-gallery.php - https://plugins.trac.wordpress.org/browser/bdthemes-element-pack-lite/trunk/modules/image-accordion/widgets/image-accordion.php - https://wordpress.org/plugins/bdthemes-element-pack-lite/#developers - https://plugins.trac.wordpress.org/changeset/3319668/ - https://feedback.bdthemes.com/announcements?category=category_6l495r8q - https://github.com/uikit/uikit/issues/5162
CVE ID: CVE-2025-5945 State: REJECTED Published: 2025-06-10T07:31:04.472Z Last Updated: 2025-06-10T08:14:34.174Z Description: No description available.
CVE ID: CVE-2025-5946 State: PUBLISHED Published: 2025-10-14T14:29:00.514Z Last Updated: 2025-10-14T16:03:12.207Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Centreon Products: Infra Monitoring Problem Types: CWE-78 Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Poller reload setup in the configuration modules) allows OS Command Injection. On the poller parameters page, a user with high privilege is able to concatenate custom instructions into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 2
into the poller reload command. This issue affects Infra Monitoring: from 24.10.0 before 24.10.13, from 24.04.0 before 24.04.18, from 23.10.0 before 23.10.28. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/centreon/centreon/releases - https://thewatch.centreon.com/latest-security-bulletins-64/cve-2025-5946-centreon-web-all-versions-high-severity-5104
CVE ID: CVE-2025-5947 State: PUBLISHED Published: 2025-08-01T03:24:46.283Z Last Updated: 2025-10-23T13:24:36.769Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aonetheme Products: Service Finder Bookings Problem Types: CWE-639 Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via authentication bypass in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's cookie value prior to logging them in through the service_finder_switch_back() function. This makes it possible for unauthenticated attackers to login as any user including admins. Additional Analyst Notes:
. This makes it possible for unauthenticated attackers to login as any user including admins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1fe4f60-d93b-4071-90ae-ac863c17fe19?source=cve - https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
CVE ID: CVE-2025-5948 State: PUBLISHED Published: 2025-09-19T05:28:51.272Z Last Updated: 2025-09-19T11:54:56.861Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aonetheme Products: Service Finder Bookings Problem Types: CWE-639 Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to claiming a business when using the claim_business AJAX action. This makes it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges
it possible for unauthenticated attackers to login as any user including admins. Please note that subscriber privileges or brute-forcing are needed when completing the business takeover. The claim_id is needed to takeover the admin account, but brute-forcing is a practical approach to obtaining valid IDs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7eb018bc-2650-4e0d-8da9-325eac826d45?source=cve - https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
CVE ID: CVE-2025-5949 State: PUBLISHED Published: 2025-11-01T04:27:42.063Z Last Updated: 2025-11-03T20:48:46.815Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: aonetheme Products: Service Finder Bookings Problem Types: CWE-639 Description: The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0. This is due to the plugin not properly validating a user's identity prior to processing a password change request. This makes it possible for authenticated attackers with subscriber access or higher to reset other users' passwords, including those of admins. Additional Analy
attackers with subscriber access or higher to reset other users' passwords, including those of admins. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a2874a5f-71f4-4bcd-87e8-a20bb19a5847?source=cve - https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
CVE ID: CVE-2025-5950 State: PUBLISHED Published: 2025-06-13T01:47:47.407Z Last Updated: 2025-06-13T14:04:03.712Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: janboddez Products: IndieBlocks Problem Types: CWE-79 Description: The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CI
bitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/41fdb3ea-1de4-4b90-a387-5932de7a5e7c?source=cve - https://plugins.trac.wordpress.org/browser/indieblocks/trunk/blocks/facepile-content/render.php#L39 - https://wordpress.org/plugins/indieblocks/#developers
CVE ID: CVE-2025-5951 State: REJECTED Published: N/A Last Updated: 2025-06-28T22:16:00.418Z Description: No description available.
CVE ID: CVE-2025-5952 State: PUBLISHED Published: 2025-06-10T05:00:14.974Z Last Updated: 2025-06-10T15:18:19.264Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C) Vendors: n/a Products: Zend.To Problem Types: CWE-78, CWE-77 Description: A vulnerability, which was classified as critical, has been found in Zend.To up to 6.10-6 Beta. This issue affects the function exec of the file NSSDropoff.php. The manipulation of the argument file_1 leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.10-7 is able to address this issue. It is recommended to upgrade the affected component.
be used. Upgrading to version 6.10-7 is able to address this issue. It is recommended to upgrade the affected component. This affects a rather old version of the software. The vendor recommends updating to the latest release. Additional countermeasures have been added in 6.15-8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.311789 - https://vuldb.com/?ctiid.311789 - https://vuldb.com/?submit.589178 - https://matheuscezar.github.io/2025/05/24/0-day-in-zend-to.html
CVE ID: CVE-2025-5953 State: PUBLISHED Published: 2025-07-04T01:44:03.834Z Last Updated: 2025-07-08T14:21:48.349Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: asaquzzaman Products: WP Human Resource Management Problem Types: CWE-862 Description: The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $_POST['role'] and, after basic cleaning via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the curre
via hrm_clean(), passes it directly to wp_insert_user() and later to $user->set_role() without verifying that the current user is allowed to assign that role. This makes it possible for authenticated attackers, with Employee-level access and above, to elevate their privileges to administrator. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3ba33a18-429f-4a3e-b018-bdfbbe6e8482?source=cve - https://wordpress.org/plugins/hrm/#developers - https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L89 - https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L543 - https://plugin
s/employee.php#L89 - https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L543 - https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L591
CVE ID: CVE-2025-5954 State: PUBLISHED Published: 2025-08-01T02:24:17.625Z Last Updated: 2025-08-01T19:08:15.236Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aonetheme Products: Service Finder SMS System Problem Types: CWE-269 Description: The Service Finder SMS System plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not restricting user role selection at the time of registration through the aonesms_fn_savedata_after_signup() function. This makes it possible for unauthenticated attackers to register as an administrator user. Additional Analyst Notes: -
. This makes it possible for unauthenticated attackers to register as an administrator user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/520c1e8b-d0c1-4201-90bf-0cefab9af7e0?source=cve - https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
CVE ID: CVE-2025-5955 State: PUBLISHED Published: 2025-09-19T04:27:05.107Z Last Updated: 2025-09-19T13:30:50.033Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: aonetheme Products: Service Finder SMS System Problem Types: CWE-288 Description: The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.0.0. This is due to the plugin not verifying a user's phone number before logging them in. This makes it possible for unauthenticated attackers to login as arbitrary users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/i
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cc4598a7-d5cf-4553-b29a-659fe288ece9?source=cve - https://themeforest.net/item/service-finder-service-and-business-listing-wordpress-theme/15208793
CVE ID: CVE-2025-5956 State: PUBLISHED Published: 2025-07-04T01:44:02.706Z Last Updated: 2025-07-08T14:27:12.158Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: asaquzzaman Products: WP Human Resource Management Problem Types: CWE-862 Description: The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-supplied $_POST['delete'] array and passes each ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which use
ID directly to wp_delete_user() without verifying that the caller has the delete_users capability or limiting which user IDs may be removed. This makes it possible for authenticated attackers, with Employee-level access and above, to delete arbitrary accounts, including administrators. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/28cf0f3f-0048-4da9-aa86-243479f7b974?source=cve - https://wordpress.org/plugins/hrm/#developers - https://plugins.trac.wordpress.org/browser/hrm/tags/2.2.17/class/employee.php#L48
CVE ID: CVE-2025-5957 State: PUBLISHED Published: 2025-07-08T04:22:59.401Z Last Updated: 2025-07-08T17:58:44.566Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: rcatheme Products: Guest Support – Complete customer support ticket system for WordPress Problem Types: CWE-862 Description: The Guest Support – Complete customer support ticket system for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteMassTickets' function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete arbitrary support tickets. Additional Analyst Notes: - CISA ADP
akes it possible for unauthenticated attackers to delete arbitrary support tickets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6e5dde2-f9f9-4a64-9174-e5e6e9fe1b23?source=cve - https://plugins.trac.wordpress.org/browser/guest-support/trunk/includes/library/ajax.php#L133 - https://plugins.trac.wordpress.org/browser/guest-support/trunk/includes/library/class-dbquery.php#L736 - https://plugins.trac.wordpress.org/changeset/3322664/
CVE ID: CVE-2025-5958 State: PUBLISHED Published: 2025-06-11T00:54:26.301Z Last Updated: 2025-06-13T03:55:21.685Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/420150619
CVE ID: CVE-2025-5959 State: PUBLISHED Published: 2025-06-11T00:54:26.711Z Last Updated: 2025-06-12T13:27:28.488Z Vendors: Google Products: Chrome Problem Types: CWE-843 Description: Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_10.html - https://issues.chromium.org/issues/422313191
CVE ID: CVE-2025-5961 State: PUBLISHED Published: 2025-07-03T13:44:11.000Z Last Updated: 2025-07-03T14:00:39.195Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Backup & Migration Problem Types: CWE-434 Description: The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected si
ble for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: Uploaded files are only accessible on WordPress instances running on the NGINX web server as the existing .htaccess within the target file upload folder prevents access on Apache servers. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d8ceb4a1-9354-4ed3-9a8f-45ba2057a810?source=cve - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2210 - https://plugins.trac.wordpress.org
/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2210 - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2235 - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/class-wpvivid-export-import.php#L2246 - https://github.com/d0n601/CVE-2025-5961 - https://ryankozak.com/posts/cve-2025-5961/ - https://plugins.trac.wordpress.org/changeset/3320877/
CVE ID: CVE-2025-5962 State: PUBLISHED Published: 2025-09-22T08:04:39.673Z Last Updated: 2025-11-11T10:23:10.278Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 Problem Types: CWE-284 Description: A flaw was found in the Lightspeed history service. Insufficient access controls allow a local, unprivileged user to access and manipulate the chat history of another user on the same system. By abusing inter-process communication calls to the history service, an attacker can view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to dece
view, delete, or inject arbitrary history entries, including misleading or malicious commands. This can be used to deceive another user into executing harmful actions, posing a risk of privilege misuse or unauthorized command execution through social engineering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:16345 - https://access.redhat.com/errata/RHSA-2025:16346 - https://access.redhat.com/security/cve/CVE-2025-5962 - https://bugzilla.redhat.com/show_bug.cgi?id=2371363
CVE ID: CVE-2025-5963 State: PUBLISHED Published: 2025-06-20T10:01:56.720Z Last Updated: 2025-06-20T13:14:37.295Z Vendors: Postbox Products: Postbox Problem Types: CWE-276 Description: The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions b