deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-49115
Published: 2024-12-12
Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49115
CVE: CVE-2024-49116
Published: 2024-12-12
Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49116
CVE: CVE-2024-49117
Published: 2024-12-12
Description: Windows Hyper-V Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-393
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49117
CVE: CVE-2024-49118
Published: 2024-12-12
Description: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49118
CVE: CVE-2024-49119
Published: 2024-12-12
Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-843, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49119
CVE: CVE-2024-49120
Published: 2024-12-12
Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-453, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49120
CVE: CVE-2024-49121
Published: 2024-12-12
Description: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49121
CVE: CVE-2024-49122
Published: 2024-12-12
Description: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49122
CVE: CVE-2024-49123
Published: 2024-12-12
Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49123
CVE: CVE-2024-49124
Published: 2024-12-12
Description: Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49124
CVE: CVE-2024-49125
Published: 2024-12-12
Description: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVSS Score: 8.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49125
CVE: CVE-2024-49126
Published: 2024-12-12
Description: Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49126
CVE: CVE-2024-49127
Published: 2024-12-12
Description: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49127
CVE: CVE-2024-49128
Published: 2024-12-12
Description: Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49128
CVE: CVE-2024-49129
Published: 2024-12-12
Description: Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49129
CVE: CVE-2024-49132
Published: 2024-12-12
Description: Windows Remote Desktop Services Remote Code Execution Vulnerability
CVSS Score: 8.1 (HIGH)
CWE: CWE-416, CWE-591, CWE-362
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49132
CVE: CVE-2024-49138
Published: 2024-12-12
Description: Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-122
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49138; https://packetstorm.news/files/id/190585/; https://www.exploit-db.com/exploits/52270
CVE: CVE-2024-49142
Published: 2024-12-12
Description: Microsoft Access Remote Code Execution Vulnerability
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49142
CVE: CVE-2024-50339
Published: 2024-12-12
Description: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.17, an unauthenticated user can retrieve all the sessions IDs and use them to steal any valid session. Version 10.0.17 contains a patch for this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-79, CWE-287, CWE-384
References: https://github.com/glpi-project/glpi/releases/tag/10.0.17; https://github.com/glpi-project/glpi/security/advisories/GHSA-v977-g4r9-6r72
CVE: CVE-2024-55587
Published: 2024-12-12
Description: python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extract.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/smartfile/python-libarchive/blob/c7677411bfc4ab5701d343bc6ebd9e35c990e80e/libarchive/zip.py#L107; https://github.com/smartfile/python-libarchive/issues/42; https://github.com/smartfile/python-libarchive/pull/41
CVE: CVE-2024-55884
Published: 2024-12-12
Description: In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhausted, leading to heap-based out-of-bounds writes in enable() in exception_logging/unix.rs, aka MLLVD-CR-24-01. NOTE: achieving code execution is considered non-trivial.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-787
References: https://github.com/mullvad/mullvadvpn-app/commit/ef6c862071b26023802b00d6e1dc6ca53d1ab3e6; https://news.ycombinator.com/item?id=42390768; https://x41-dsec.de/news/2024/12/11/mullvad/
CVE: CVE-2024-12490
Published: 2024-12-12
Description: A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /pages/teacher_save.php. The manipulation of the argument salut leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/bjtyyy/CVE/blob/main/Online%20Class%20and%20Exam%20Scheduling%20System_teacher_save_php.docx; https://vuldb.com/?ctiid.287872
CVE: CVE-2024-12492
Published: 2024-12-12
Description: A vulnerability was found in code-projects Farmacia 1.0. It has been rated as critical. This issue affects some unknown processing of the file /visualizar-usuario.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/A1ph4D3v1l/cve/blob/main/sql-x.md; https://vuldb.com/?ctiid.287873
CVE: CVE-2024-12497
Published: 2024-12-12
Description: A vulnerability classified as critical has been found in 1000 Projects Attendance Tracking Management System 1.0. Affected is an unknown function of the file /admin/check_admin_login.php. The manipulation of the argument admin_user_name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://1000projects.org/; https://github.com/Ta0k1a/CVE/issues/1; https://vuldb.com/?ctiid.287874
CVE: CVE-2024-12503
Published: 2024-12-12
Description: A vulnerability classified as problematic was found in ClassCMS 4.8. Affected by this vulnerability is an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the argument URL leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/Jack-Black-13/blob/blob/main/classCMS_v4.8_model_xss.md; https://vuldb.com/?ctiid.287875; https://vuldb.com/?id.287875
CVE: CVE-2024-12536
Published: 2024-12-12
Description: A vulnerability, which was classified as problematic, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/client_data.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://vuldb.com/?ctiid.287912; https://vuldb.com/?id.287912; https://vuldb.com/?submit.461130
CVE: CVE-2024-41146
Published: 2024-12-12
Description: Use of Multiple Resources with Duplicate Identifier (CWE-694) in the Controller 6000 and Controller 7000 Platforms could allow an attacker with physical access to HBUS communication cabling to perform a Denial-of-Service attack against HBUS connected devices, require a device reboot to resolve. 

This issue affects: Controller 6000 and Controller 7000 firmware versions 9.10 prior to vCR9.10.241108a (distributed in 9.10.2149 (MR4)), 9.00 prior to vCR9.00.241108a (distributed in 9.00.2374 (MR5)), 8.90 prior to vCR8.90.241107a (distributed in 8.90.2356 (MR6)), all versions of 8.80 and prior.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-694
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-41146
CVE: CVE-2024-42407
Published: 2024-12-12
Description: Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. 

This issue affects: Command Centre Server 9.10 prior to 9.10.2149 (MR4), 9.00 prior to 9.00.2374 (MR5), 8.90 prior to 8.90.2356 (MR6), all versions of 8.80 and prior.
CVSS Score: 8.5 (HIGH)
CWE: CWE-532
References: https://security.gallagher.com/en-NZ/Security-Advisories/CVE-2024-42407
CVE: CVE-2024-44200
Published: 2024-12-12
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An app may be able to read sensitive location information.
CVSS Score: 3.3 (LOW)
CWE: CWE-922
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564
CVE: CVE-2024-44201
Published: 2024-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.1 and iPadOS 18.1, iPadOS 17.7.3, macOS Sequoia 15.1, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. Processing a malicious crafted file may lead to a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-404
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121838
CVE: CVE-2024-44212
Published: 2024-12-12
Description: A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, tvOS 18.1, visionOS 2.1, watchOS 11.1. Cookies belonging to one origin may be sent to another origin.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-346, CWE-346
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44220
Published: 2024-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. Parsing a maliciously crafted video file may lead to unexpected system termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-434
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; http://seclists.org/fulldisclosure/2024/Dec/7
CVE: CVE-2024-44224
Published: 2024-12-12
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276, CWE-276
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-44225
Published: 2024-12-12
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2, tvOS 18.2, watchOS 11.2. An app may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/121837; https://support.apple.com/en-us/121838; https://support.apple.com/en-us/121839
CVE: CVE-2024-44241
Published: 2024-12-12
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-770
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564
CVE: CVE-2024-44242
Published: 2024-12-12
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564
CVE: CVE-2024-44243
Published: 2024-12-12
Description: A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.3. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/122069; http://seclists.org/fulldisclosure/2024/Dec/7
CVE: CVE-2024-44245
Published: 2024-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, macOS Sonoma 14.7.2, visionOS 2.2. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/121837; https://support.apple.com/en-us/121838; https://support.apple.com/en-us/121839
CVE: CVE-2024-44246
Published: 2024-12-12
Description: The issue was addressed with improved routing of Safari-originated requests. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2. On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/121837; https://support.apple.com/en-us/121838; https://support.apple.com/en-us/121839
CVE: CVE-2024-44248
Published: 2024-12-12
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. A user with screen sharing access may be able to view another user's screen.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-44290
Published: 2024-12-12
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, watchOS 11.1. An app may be able to determine a user’s current location.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121565
CVE: CVE-2024-44291
Published: 2024-12-12
Description: A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. A malicious app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-44299
Published: 2024-12-12
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1. An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/121563; https://support.apple.com/en-us/121564
CVE: CVE-2024-44300
Published: 2024-12-12
Description: A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-53272
Published: 2024-12-12
Description: Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `login` and `social media` function in `RegisterLoginReset.vue` contains two reflected XSS vulnerabilities due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf; https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica/
CVE: CVE-2024-53273
Published: 2024-12-12
Description: Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `RegisterLoginReset.vue` contains a reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability, giving the attacker control of the victim’s account when a victim registers or logins with a specially crafted link. Version 5.28.5 contains a patch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf; https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica/
CVE: CVE-2024-53274
Published: 2024-12-12
Description: Habitica is an open-source habit-building program. Versions prior to 5.28.5 are vulnerable to reflected cross-site scripting. The `register` function in `home.vue` containsa reflected XSS vulnerability due to an incorrect sanitization function. An attacker can specify a malicious `redirectTo` parameter to trigger the vulnerability. Arbitrary javascript can be executed by the attacker in the context of the victim’s session. Version 5.28.5 contains a patch.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/HabitRPG/habitica/commit/946ade5da1f52a804ef2ba76d49416c43e8166bf; https://securitylab.github.com/advisories/GHSL-2024-109_GHSL-2024-111_habitica/
CVE: CVE-2024-53845
Published: 2024-12-12
Description: ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.
CWE: CWE-327, CWE-909
References: https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2; https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2; https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db
CVE: CVE-2024-54465
Published: 2024-12-12
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-281
References: https://support.apple.com/en-us/121839; http://seclists.org/fulldisclosure/2024/Dec/7
CVE: CVE-2024-54466
Published: 2024-12-12
Description: An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An encrypted volume may be accessed by a different user without prompting for the password.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-54471
Published: 2024-12-12
Description: This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious application may be able to leak a user's credentials.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://support.apple.com/en-us/121564; https://support.apple.com/en-us/121568; https://support.apple.com/en-us/121570
CVE: CVE-2024-54474
Published: 2024-12-12
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-54476
Published: 2024-12-12
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-54477
Published: 2024-12-12
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-922
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121840; https://support.apple.com/en-us/121842
CVE: CVE-2024-54479
Published: 2024-12-12
Description: The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to an unexpected process crash.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/121837; https://support.apple.com/en-us/121838; https://support.apple.com/en-us/121839