{"vulnerability": "CVE-2020-2790", "sightings": [{"uuid": "654ee16f-8646-4996-a2b1-61f097aff164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27900", "type": "seen", "source": "https://t.me/cibsecurity/17299", "content": "\u203c CVE-2020-27900 \u203c\n\nAn issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Big Sur 11.0.1. A malicious application may be able to preview files it does not have access to.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-09T00:36:24.000000Z"}, {"uuid": "f3d05a3c-a976-4456-bf61-bb2de5a273f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27906", "type": "seen", "source": "https://t.me/cibsecurity/17298", "content": "\u203c CVE-2020-27906 \u203c\n\nMultiple integer overflows were addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1. A remote attacker may be able to cause unexpected application termination or heap corruption.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2020-12-09T00:36:23.000000Z"}, {"uuid": "47ed1008-7cae-4f1e-b971-ec998df74d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27904", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3318", "content": "BlackHat ASIA 2021:\nA tfp0 bug for macOS <=10.15.x (PoC for CVE-2020-27904)\nhttps://www.blackhat.com/asia-21/briefings/schedule/#the-price-of-compatibility-defeating-macos-kernel-using-extended-file-attributes-21799\n]-> PoC:\nhttps://github.com/pattern-f/xattr-oob-swap", "creation_timestamp": "2021-05-08T13:05:01.000000Z"}, {"uuid": "3607d1d2-4a8f-44e9-b1c0-9619e7153d6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27904", "type": "seen", "source": "https://t.me/cissp/3149", "content": "Offensive security\nMicro Backdoor for Windows:\nSmall and convenient C2 tool for Windows targets\ud83d\ude01\nhttps://github.com/Cr4sh/MicroBackdoor\n\nBlue Team Techniques\neBPF-based Networking, Security, and Observability\ud83d\ude07\nhttps://github.com/cilium/cilium\n\nMalware analysis\n1. Lemon Duck spreads its wings:\nActors target Microsoft Exchange servers, incorporate new TTPs\nhttps://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html?m=1\n2. An alternative way to deal with Android Malware\nhttps://github.com/UDcide/udcide\n\nBlackHat ASIA 2021:\nA tfp0 bug for macOS <=10.15.x (PoC for CVE-2020-27904)\nhttps://www.blackhat.com/asia-21/briefings/schedule/#the-price-of-compatibility-defeating-macos-kernel-using-extended-file-attributes-21799\n]-> PoC:\nhttps://github.com/pattern-f/xattr-oob-swap", "creation_timestamp": "2026-09-01T17:00:50.812066Z"}, {"uuid": "86eff8a6-1cdd-45fc-a9f8-35f3ee7d2a1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27904", "type": "seen", "source": "https://t.me/cissp/3149", "content": "Offensive security\nMicro Backdoor for Windows:\nSmall and convenient C2 tool for Windows targets\ud83d\ude01\nhttps://github.com/Cr4sh/MicroBackdoor\n\nBlue Team Techniques\neBPF-based Networking, Security, and Observability\ud83d\ude07\nhttps://github.com/cilium/cilium\n\nMalware analysis\n1. Lemon Duck spreads its wings:\nActors target Microsoft Exchange servers, incorporate new TTPs\nhttps://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html?m=1\n2. An alternative way to deal with Android Malware\nhttps://github.com/UDcide/udcide\n\nBlackHat ASIA 2021:\nA tfp0 bug for macOS <=10.15.x (PoC for CVE-2020-27904)\nhttps://www.blackhat.com/asia-21/briefings/schedule/#the-price-of-compatibility-defeating-macos-kernel-using-extended-file-attributes-21799\n]-> PoC:\nhttps://github.com/pattern-f/xattr-oob-swap", "creation_timestamp": "2026-09-02T01:04:39.855829Z"}, {"uuid": "dd97a018-e0d4-4b38-b2fb-ff035c9c7f1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27904", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3149", "content": "Offensive security\nMicro Backdoor for Windows:\nSmall and convenient C2 tool for Windows targets\ud83d\ude01\nhttps://github.com/Cr4sh/MicroBackdoor\n\nBlue Team Techniques\neBPF-based Networking, Security, and Observability\ud83d\ude07\nhttps://github.com/cilium/cilium\n\nMalware analysis\n1. Lemon Duck spreads its wings:\nActors target Microsoft Exchange servers, incorporate new TTPs\nhttps://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html?m=1\n2. An alternative way to deal with Android Malware\nhttps://github.com/UDcide/udcide\n\nBlackHat ASIA 2021:\nA tfp0 bug for macOS <=10.15.x (PoC for CVE-2020-27904)\nhttps://www.blackhat.com/asia-21/briefings/schedule/#the-price-of-compatibility-defeating-macos-kernel-using-extended-file-attributes-21799\n]-> PoC:\nhttps://github.com/pattern-f/xattr-oob-swap", "creation_timestamp": "2026-09-11T07:00:04.902851Z"}, {"uuid": "6452176e-59cd-40a8-8887-4b5fbee5c929", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27904", "type": "published-proof-of-concept", "source": "https://t.me/cissp/3149", "content": "Offensive security\nMicro Backdoor for Windows:\nSmall and convenient C2 tool for Windows targets\ud83d\ude01\nhttps://github.com/Cr4sh/MicroBackdoor\n\nBlue Team Techniques\neBPF-based Networking, Security, and Observability\ud83d\ude07\nhttps://github.com/cilium/cilium\n\nMalware analysis\n1. Lemon Duck spreads its wings:\nActors target Microsoft Exchange servers, incorporate new TTPs\nhttps://blog.talosintelligence.com/2021/05/lemon-duck-spreads-wings.html?m=1\n2. An alternative way to deal with Android Malware\nhttps://github.com/UDcide/udcide\n\nBlackHat ASIA 2021:\nA tfp0 bug for macOS <=10.15.x (PoC for CVE-2020-27904)\nhttps://www.blackhat.com/asia-21/briefings/schedule/#the-price-of-compatibility-defeating-macos-kernel-using-extended-file-attributes-21799\n]-> PoC:\nhttps://github.com/pattern-f/xattr-oob-swap", "creation_timestamp": "2026-09-12T00:00:49.306582Z"}]}