CVE-2018-8076

ZenMate 1.5.4 for macOS suffers from a type confusion vulnerability within the com.zenmate.chron-xpc LaunchDaemon component. The LaunchDaemon implements an XPC service that uses an insecure XPC API for accessing data from an inbound XPC message. This could potentially result in an XPC object of the wrong type being passed as the first argument to the xpc_connection_create_from_endpoint function if controlled by an attacker. In recent versions of macOS and OS X, Apple has implemented an internal check to prevent such XPC API abuse from occurring, thus making this vulnerability only result in a denial of service if exploited by an attacker.

• CWE-704

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-016.mdThird Party Advisory
• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-016.mdThird Party Advisory

Published

Mar 15, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8069QCMS version 3.0 has XSS via the webname parameter to the /b…
• CVE-2018-8070QCMS version 3.0 has XSS via the title parameter to the /gue…
• CVE-2018-8071Mautic before v2.13.0 has stored XSS via a theme config file…
• CVE-2018-8072An issue was discovered on EDIMAX IC-3140W through 3.06, IC-…
• CVE-2018-8073Yii 2.x before 2.0.15 allows remote attackers to execute arb…
• CVE-2018-8074Yii 2.x before 2.0.15 allows remote attackers to inject unin…
• CVE-2018-8078YzmCMS 3.7 has Stored XSS via the title parameter to adverti…
• CVE-2018-8086Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-8087Memory leak in the hwsim_new_radio_nl function in drivers/ne…
• CVE-2018-8088org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SL…9.8
• CVE-2018-8090Quick Heal Total Security 64 bit 17.00 (QHTS64.exe), (QHTSFT…7.8
• CVE-2018-8092Mautic before 2.13.0 allows CSV injection.