Trunk.cocoapods.org vulnerabilities

3 known vulnerabilities in Trunk.cocoapods.org from CocoaPods. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  CocoaPods: Exposure of Resource to Wrong Sphere

  CVE-2024-38368Jul 1, 2024CocoaPodsEPSS 14.9%

  trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. If the pods had never been claimed then it was still possible to do so.

• 9.6 Critical severity

  CocoaPods: Exposure of Data Element to Wrong Session

  CVE-2024-38367Jul 1, 2024CocoaPodsEPSS 11.1%

  trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s sess

• 10.0 Critical severity

  CocoaPods: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2024-38366Jul 1, 2024CocoaPodsEPSS 17.8%

  trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX rec