CVE-2024-44309

Apple's iOS and macOS products contain an actively exploited XSS vulnerability that allows attackers to inject malicious scripts into web content.

This cross-site scripting (XSS) vulnerability in Apple's iOS and macOS products allows attackers to inject malicious scripts into web content, potentially leading to credential theft or session hijacking. For DIB organizations, this poses a significant risk as Apple devices are widely used in government and defense environments, and the vulnerability is actively being exploited in the wild. Organizations should immediately update to patched versions of iOS and macOS and implement additional web content filtering to mitigate the risk.

Shame score — While the vulnerability is actively exploited, it is a common XSS issue that Apple has disclosed and patched, making it less avoidable than negligent security practices.