CVE-2024-22405

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This issue was fixed in XADMaster 1.10.8. It is recommended to upgrade to the latest version. There are no known workarounds for this issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-281

Affected software

No affected versions have been published.

Timeline

Published: Apr 30, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-224069.8Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search t CVE-2024-224076.5Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authoriz CVE-2024-224088.1Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately v CVE-2024-224098.8DataHub is an open-source metadata platform. In affected versions a low privileged user could remove a user, edit group members, or edit ano CVE-2024-22416.3Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintend CVE-2024-224107.8Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs p CVE-2024-224115.4Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12, any HTML inside text that is passed to `error` or `succeed CVE-2024-224124.9ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0 CVE-2024-224145.4flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execu CVE-2024-224159.8jupyter-lsp is a coding assistance tool for JupyterLab (code navigation + hover suggestions + linters + autocompletion + rename) using Langu CVE-2024-224168.8pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests CVE-2024-224176.1Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate th