CVE-2020-14977

An issue was discovered in F-Secure SAFE 17.7 on macOS. The XPC services use the PID to identify the connecting client, which allows an attacker to perform a PID reuse attack and connect to a privileged XPC service, and execute privileged commands on the system. NOTE: the attacker needs to execute code on an already compromised machine.

• https://theevilbit.github.io/posts/Exploit, Third Party Advisory
• https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fameVendor Advisory
• https://www.f-secure.com/en/home/products/safeVendor Advisory
• https://theevilbit.github.io/posts/Exploit, Third Party Advisory
• https://www.f-secure.com/en/business/programs/vulnerability-reward-program/hall-of-fameVendor Advisory
• https://www.f-secure.com/en/home/products/safeVendor Advisory

Published

Jun 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14971Pi-hole through 5.0 allows code injection in piholedhcp (the…7.8
• CVE-2020-14972Multiple SQL injection vulnerabilities in Sourcecodester Pis…9.8
• CVE-2020-14973The loginForm within the general/login.php webpage in webTar…6.1
• CVE-2020-14974The driver in IOBit Unlocker 1.1.2 allows a low-privileged u…7.1
• CVE-2020-14975The driver in IOBit Unlocker 1.1.2 allows a low-privileged u…7.8
• CVE-2020-14976GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server…5.5
• CVE-2020-14978An issue was discovered in F-Secure SAFE 17.7 on macOS. Due …8.1
• CVE-2020-14979The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA P…7.8
• CVE-2020-1498A remote code execution vulnerability exists in Microsoft Ex…8.8
• CVE-2020-14980The Sophos Secure Email application through 3.9.4 for Androi…5.9
• CVE-2020-14981The ThreatTrack VIPRE Password Vault app through 1.100.1090 …5.9
• CVE-2020-14982A Blind SQL Injection vulnerability in Kronos WebTA 3.8.x an…6.5