Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
network request). This issue may lead to reflected Cross-Site Scripting (XSS) in the context of Common Voice’s server origin. As of time of publication, it is unknown whether any patches or workarounds exist. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-026_Common_Voice/ - https://github.com/mozilla/common-voice/blob/9d6ffd755e29b81918b86b9f5218b9c27d9c1c1a/server/src/fetch-legal-document.ts#LL21-L62C2 - https://github.com/mozilla/common-voice/blob/9d6ffd755e29b81918b86b9f5218b9c27d9c1c1a/server/src/server.ts#L214
CVE ID: CVE-2023-42809 State: PUBLISHED Published: 2023-10-04T19:18:39.875Z Last Updated: 2024-09-19T18:59:38.518Z Severity: CRITICAL (CVSS 9.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: redisson Products: redisson Problem Types: CWE-502 Description: Redisson is a Java Redis client that uses the Netty framework. Prior to version 3.22.0, some of the messages received from the Redis server contain Java objects that the client deserializes without further validation. Attackers that manage to trick clients into communicating with a malicious server can include especially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This c
ially crafted objects in its responses that, once deserialized by the client, force it to execute arbitrary code. This can be abused to take control of the machine the client is running in. Version 3.22.0 contains a patch for this issue. Some post-fix advice is available. Do NOT use `Kryo5Codec` as deserialization codec, as it is still vulnerable to arbitrary object deserialization due to the `setRegistrationRequired(false)` call. On the contrary, `KryoCodec` is safe to use. The fix applied to `SerializationCodec` only consists of adding an optional allowlist of class names, even though making this behavior the default is recommended. When instantiating `SerializationCodec` please use the `S
, even though making this behavior the default is recommended. When instantiating `SerializationCodec` please use the `SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses)` constructor to restrict the allowed classes for deserialization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://securitylab.github.com/advisories/GHSL-2023-053_Redisson/ - https://github.com/redisson/redisson/commit/fe6a2571801656ff1599ef87bdee20f519a5d1fe
CVE ID: CVE-2023-42810 State: PUBLISHED Published: 2023-09-21T17:11:54.756Z Last Updated: 2024-09-24T14:58:02.906Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: sebhildebrandt Products: systeminformation Problem Types: CWE-77 Description: systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
works()` (string only). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-gx6r-qc2v-3p3v - https://github.com/sebhildebrandt/systeminformation/commit/7972565812ccb2a610a22911c54c3446f4171392 - https://systeminformation.io/security.html
CVE ID: CVE-2023-42811 State: PUBLISHED Published: 2023-09-22T15:19:15.445Z Last Updated: 2025-06-18T14:22:56.534Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:N) Vendors: RustCrypto Products: AEADs Problem Types: CWE-347 Description: aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails. If a program using the `aes-gcm` crate's `decrypt_in_place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Dep
place*` APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery. Version 0.10.3 contains a fix for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RustCrypto/AEADs/security/advisories/GHSA-423w-p2w9-r7vq - https://docs.rs/aes-gcm/latest/src/aes_gcm/lib.rs.html#309 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3M
tps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RYQCICN6BVC6I75O3F6W4VK4J3MOYDJU/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U67ZSMNX5V3WTBYPUYF45PSFG4SF5SGF/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ROBB6TBDAGEQ2WIINR34F3DPSN3FND6K/
CVE ID: CVE-2023-42812 State: PUBLISHED Published: 2023-09-22T16:07:02.731Z Last Updated: 2024-09-24T14:25:37.165Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: galaxyproject Products: galaxy Problem Types: CWE-918 Description: Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their responses. Version 22.05 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/galaxypro
. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/galaxyproject/galaxy/security/advisories/GHSA-vf5q-r8p9-35xh - https://github.com/galaxyproject/galaxy/blob/06d56c859713b74f1c2e35da1c2fcbbf0a965645/lib/galaxy/files/uris.py
CVE ID: CVE-2023-42813 State: PUBLISHED Published: 2023-11-13T20:34:23.826Z Last Updated: 2024-08-02T19:30:23.998Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: kyverno Products: kyverno Problem Types: CWE-400 Description: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch attestations. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The
ition, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/securit
in the wild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v - https://github.com/kyverno/kyverno/pull/8428 - https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2 - https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b
CVE ID: CVE-2023-42814 State: PUBLISHED Published: 2023-11-13T20:34:05.257Z Last Updated: 2024-08-02T19:30:24.296Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: kyverno Products: kyverno Problem Types: CWE-835 Description: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch attestations. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The ma
on, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/security/a
the wild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r - https://github.com/kyverno/kyverno/pull/8428 - https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2 - https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b
CVE ID: CVE-2023-42815 State: PUBLISHED Published: 2023-11-13T20:33:24.955Z Last Updated: 2024-08-02T19:30:24.650Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: kyverno Products: kyverno Problem Types: CWE-835 Description: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch signatures. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicio
he attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/security/adviso
ild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262 - https://github.com/kyverno/kyverno/pull/8428 - https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2 - https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b
CVE ID: CVE-2023-42816 State: PUBLISHED Published: 2023-11-13T20:23:16.248Z Last Updated: 2024-08-02T19:30:24.686Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H) Vendors: kyverno Products: kyverno Problem Types: CWE-345 Description: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch signatures. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The mali
, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/security/adv
e wild. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r - https://github.com/kyverno/kyverno/pull/8428 - https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2 - https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b
CVE ID: CVE-2023-42817 State: PUBLISHED Published: 2023-09-25T18:57:33.735Z Last Updated: 2024-09-24T14:43:34.632Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: pimcore Products: admin-ui-classic-bundle Problem Types: CWE-79 Description: Pimcore admin-ui-classic-bundle provides a Backend UI for Pimcore. The translation value with text including “%s” (from “%suggest%) is parsed by sprintf() even though it’s supposed to be output literally to the user. The translations may be accessible by a user with comparatively lower overall access (as the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the pa
the translation permission cannot be scoped to certain “modules”) and a skilled attacker might be able to exploit the parsing of the translation string in the dialog box. This issue has been patched in commit `abd77392` which is included in release 1.1.2. Users are advised to update to version 1.1.2 or apply the patch manually. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/admin-ui-classic-bundle/security/advisories/GHSA-m988-7375-7g2c - https://github.com/pimcore/admin-ui-classic-bundle/commit/abd7739298f974319e3cac3fd4fcd7f995b63e4c
CVE ID: CVE-2023-42818 State: PUBLISHED Published: 2023-09-27T20:28:30.507Z Last Updated: 2025-03-25T19:28:32.560Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: jumpserver Products: jumpserver Problem Types: CWE-287 Description: JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding SSH private key. An attacker could exploit a vulnerability by utilizing a disclosed public key to attempt brute-force authentication against the SSH service This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds
e This issue has been patched in versions 3.6.5 and 3.5.6. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-jv3c-27cv-w8jv - https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2
CVE ID: CVE-2023-42819 State: PUBLISHED Published: 2023-09-26T20:40:41.578Z Last Updated: 2024-09-23T20:26:00.445Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: jumpserver Products: jumpserver Problem Types: CWE-22 Description: JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu and create a playbook named 'test'. Get the playbook id from the detail page, like 'e0adabef-c38f-492d-bd92-832bacc3df5f'. An attacker can exploit the directory traversal flaw using the provided URL to access and retrieve the contents of the file. `https://jumpserver-ip/api/v1/
ry traversal flaw using the provided URL to access and retrieve the contents of the file. `https://jumpserver-ip/api/v1/ops/playbook/e0adabef-c38f-492d-bd92-832bacc3df5f/file/?key=../../../../../../../etc/passwd` a similar method to modify the file content is also present. This issue has been addressed in version 3.6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-ghg2-2whp-6m33 - https://github.com/jumpserver/jumpserver/commit/d0321a74f1713d031560341c8fd0a1859e6510d8
CVE ID: CVE-2023-42820 State: PUBLISHED Published: 2023-09-26T20:35:22.853Z Last Updated: 2024-09-23T20:26:58.683Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: jumpserver Products: jumpserver Problem Types: CWE-200 Description: JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local authentication are also not affected. Users are advised to upgrade to either version 2.28.19 or to 3.6.5. There are no known workarounds or this
ot affected. Users are advised to upgrade to either version 2.28.19 or to 3.6.5. There are no known workarounds or this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-7prv-g565-82qp - https://github.com/jumpserver/jumpserver/commit/42337f0d00b2a8d45ef063eb5b7deeef81597da5
CVE ID: CVE-2023-42821 State: PUBLISHED Published: 2023-09-22T16:55:33.355Z Last Updated: 2024-09-24T19:27:42.779Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: gomarkdown Products: markdown Problem Types: CWE-125 Description: The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `0.0.0-20230922105210-14b16010c2ee`, which corresponds with commit `14b16010c2ee7ff33a940a541d993bd043a88940`, parsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability. To exploit the vulnerability, parser needs to have `parser.Mmark` e
on could result in out-of-bounds read vulnerability. To exploit the vulnerability, parser needs to have `parser.Mmark` extension set. The panic occurs inside the `citation.go` file on the line 69 when the parser tries to access the element past its length. This can result in a denial of service. Commit `14b16010c2ee7ff33a940a541d993bd043a88940`/pseudoversion `0.0.0-20230922105210-14b16010c2ee` contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gomarkdown/markdown/security/advisories/GHSA-m9xq-6h2j-65r2 - https://github.com/gomarkdown/markdown/commit/14b16010c2ee7ff33a940a541d993bd043a88940 - https://gi
HSA-m9xq-6h2j-65r2 - https://github.com/gomarkdown/markdown/commit/14b16010c2ee7ff33a940a541d993bd043a88940 - https://github.com/gomarkdown/markdown/blob/7478c230c7cd3e7328803d89abe591d0b61c41e4/parser/citation.go#L69
CVE ID: CVE-2023-42822 State: PUBLISHED Published: 2023-09-27T17:55:02.416Z Last Updated: 2025-11-03T19:28:19.810Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: neutrinolabs Products: xrdp Problem Types: CWE-125 Description: xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-
eged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-2hjx-rm4f-r9hw - https://github.com/neutrinolabs/xrdp/commit/73acbe1f7957c65122b00de4d6f57a8d0d257c40 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/mess
5122b00de4d6f57a8d0d257c40 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PFGL22QQF65OIZRMCKUZCVJQCKGUBRYE/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTXODUR4ILM7ZPA6ZGY6VSK4BBSBMKGY/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5FPGA4M7IYCP7OILDF2ZJEVSXUOFEFQ6/
CVE ID: CVE-2023-42823 State: PUBLISHED Published: 2024-02-21T06:41:52.495Z Last Updated: 2025-11-04T19:21:58.985Z Vendors: Apple Products: iOS and iPadOS, tvOS, macOS, watchOS Problem Types: An app may be able to access user-sensitive data Description: The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1, macOS Ventura 13.6.1. An app may be able to access user-sensitive data. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://support.apple.com/en-us/HT213981 - https://support.apple.com/en-us/HT213987 - https:/
m Container: References: - https://support.apple.com/en-us/HT213981 - https://support.apple.com/en-us/HT213987 - https://support.apple.com/en-us/HT213984 - https://support.apple.com/en-us/HT213988 - https://support.apple.com/en-us/HT213985 - https://support.apple.com/en-us/HT213982 - https://support.apple.com/en-us/HT213983
CVE ID: CVE-2023-42824 State: PUBLISHED Published: 2023-10-04T18:02:20.884Z Last Updated: 2025-11-04T19:22:01.229Z Vendors: Apple Products: iOS and iPadOS Problem Types: A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6. Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnri
exploited against versions of iOS before iOS 16.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213972
CVE ID: CVE-2023-42826 State: PUBLISHED Published: 2024-01-10T22:03:14.217Z Last Updated: 2025-11-04T19:22:02.332Z Vendors: Apple Products: macOS Problem Types: Processing a file may lead to arbitrary code execution Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.apple.com/en-us/HT213940