deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49864
Published: 2024-01-10
Description: An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to arbitrary file read.This vulnerability is triggered by the `downloadURL_image` parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-73, CWE-610
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1880; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1880; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1880
CVE: CVE-2023-50172
Published: 2024-01-10
Description: A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-640
References: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897; https://talosintelligence.com/vulnerability_reports/TALOS-2023-1897; https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1897
CVE: CVE-2023-51962
Published: 2024-01-10
Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-setIptvInfo-944beaf189db4bf49f99a7a7418c7bdd; https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-setIptvInfo-944beaf189db4bf49f99a7a7418c7bdd
CVE: CVE-2023-51967
Published: 2024-01-10
Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36; https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36
CVE: CVE-2023-51968
Published: 2024-01-10
Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36; https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36
CVE: CVE-2023-51969
Published: 2024-01-10
Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36; https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36
CVE: CVE-2023-51970
Published: 2024-01-10
Description: Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787, CWE-787
References: https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36; https://grove-laser-8ad.notion.site/Tenda-AX1803-Buffer-Overflow-in-getIptvInfo-f5918cc2828c49e78554f456bf7d4b36
CVE: CVE-2023-29444
Published: 2024-01-10
Description: An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their malicious version to gain initial access and code execution.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-427, CWE-427
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03; https://www.ptc.com/en/support/article/cs399528; https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03
CVE: CVE-2023-37932
Published: 2024-01-10
Description: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability [CWE-22] in FortiVoiceEntreprise version 7.0.0 and before 6.4.7 allows an authenticated attacker to read arbitrary files from the system via sending crafted HTTP or HTTPS requests
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://fortiguard.com/psirt/FG-IR-23-219; https://fortiguard.com/psirt/FG-IR-23-219
CVE: CVE-2023-37934
Published: 2024-01-10
Description: An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiPAM 1.0 all versions allows an authenticated attacker to perform a denial of service attack via sending crafted HTTP or HTTPS requests in a high frequency.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://fortiguard.com/psirt/FG-IR-23-226; https://fortiguard.com/psirt/FG-IR-23-226
CVE: CVE-2023-44250
Published: 2024-01-10
Description: An improper privilege management vulnerability [CWE-269] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a FortiProxy HA cluster version 7.4.0 through 7.4.1 allows an authenticated attacker to perform elevated actions via crafted HTTP or HTTPS requests.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://fortiguard.com/psirt/FG-IR-23-315; https://fortiguard.com/psirt/FG-IR-23-315
CVE: CVE-2023-46712
Published: 2024-01-10
Description: A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attacker to escalate its privilege via specifically crafted HTTP requests.
CVSS Score: 7.2 (HIGH)
CWE: CWE-284
References: https://fortiguard.com/psirt/FG-IR-23-395; https://fortiguard.com/psirt/FG-IR-23-395
CVE: CVE-2023-48783
Published: 2024-01-10
Description: An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least read-only permissions to access to other organization endpoints via crafted GET requests.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-639
References: https://fortiguard.com/psirt/FG-IR-23-408; https://fortiguard.com/psirt/FG-IR-23-408
CVE: CVE-2023-50916
Published: 2024-01-10
Description: Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local path to a UNC path. It allows administrators to configure the backup location of the database used by the application. Attempting to change this location to a UNC path via the GUI is rejected due to the use of a \ (backslash) character, which is supposed to be disallowed in a pathname. Intercepting and modifying this request via a proxy, or sending the request directly to the application endpoint, allows UNC paths to be set for the backup location. Once such a location is set, Kyocera Device Manager attempts to confirm access and will try to authenticate to the UNC path; depending on the configuration of the environment, this may authenticate to the UNC with Windows NTLM hashes. This could allow NTLM credential relaying or cracking attacks.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.kyoceradocumentsolutions.us/en/about-us/pr-and-award-certifications/press/kyocera-device-manager-cve-2023-50196-vulnerability-solution-update.html; https://www.trustwave.com/en-us/resources/security-resources/security-advisories/; https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-001_kyocera-v2.txt
CVE: CVE-2023-31488
Published: 2024-01-10
Description: Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco Secure Email Gateway, and various non-Cisco products, allow attackers to trigger a segmentation fault and execute arbitrary code via a crafted document.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://bst.cisco.com/quickview/bug/CSCwe11003; https://bst.cisco.com/quickview/bug/CSCwe11003
CVE: CVE-2023-51195
Published: 2024-01-10
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-45793
Published: 2024-01-10
Description: Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276, CWE-276
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-262-04; https://www.dragos.com/advisory/omron-plc-and-engineering-software-network-and-file-format-access/; https://www.fa.omron.co.jp/product/security/assets/pdf/en/OMSR-2023-009_en.pdf
CVE: CVE-2023-29445
Published: 2024-01-10
Description: An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03; https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/; https://www.ptc.com/en/support/article/cs399528
CVE: CVE-2023-29446
Published: 2024-01-10
Description: An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-40, CWE-20
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03; https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/; https://www.ptc.com/en/support/article/cs399528
CVE: CVE-2023-29447
Published: 2024-01-10
Description: An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-522, CWE-522
References: https://www.cisa.gov/news-events/ics-advisories/icsa-23-243-03; https://www.dragos.com/advisory/ptcs-kepserverex-vulnerabilities/; https://www.ptc.com/en/support/article/cs399528
CVE: CVE-2023-51126
Published: 2024-01-10
Description: Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-77
References: https://github.com/risuxx/CVE-2023-51126; https://github.com/risuxx/CVE-2023-51126
CVE: CVE-2023-51127
Published: 2024-01-10
Description: FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/risuxx/CVE-2023-51127; https://github.com/risuxx/CVE-2023-51127
CVE: CVE-2023-52064
Published: 2024-01-10
Description: Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://gist.github.com/n0Sleeper/544b38c95715b13efadab329692c8aea; https://github.com/wuzhicms/wuzhicms/issues/208; https://gist.github.com/n0Sleeper/544b38c95715b13efadab329692c8aea
CVE: CVE-2022-32919
Published: 2024-01-10
Description: The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Visiting a website that frames malicious content may lead to UI spoofing.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-1021, CWE-1021
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-32931
Published: 2024-01-10
Description: This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privileges may be able to access private information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200, CWE-269
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-42816
Published: 2024-01-10
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2024/Mar/21; https://support.apple.com/en-us/HT213488; https://support.apple.com/kb/HT214084
CVE: CVE-2022-42839
Published: 2024-01-10
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to read sensitive location information.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-46710
Published: 2024-01-10
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-841
References: https://support.apple.com/en-us/HT213530; https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213530
CVE: CVE-2022-46721
Published: 2024-01-10
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-47915
Published: 2024-01-10
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-47965
Published: 2024-01-10
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-48504
Published: 2024-01-10
Description: The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-48577
Published: 2024-01-10
Description: An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2023-28185
Published: 2024-01-10
Description: An integer overflow was addressed through improved input validation. This issue is fixed in tvOS 16.4, macOS Big Sur 11.7.5, iOS 16.4 and iPadOS 16.4, watchOS 9.4, macOS Monterey 12.6.4, iOS 15.7.4 and iPadOS 15.7.4. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-190, CWE-190
References: https://support.apple.com/en-us/HT213673; https://support.apple.com/en-us/HT213674; https://support.apple.com/en-us/HT213675
CVE: CVE-2023-28197
Published: 2024-01-10
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An app may be able to access user-sensitive data.
CVSS Score: 3.3 (LOW)
CWE: CWE-284
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213675; https://support.apple.com/en-us/HT213677
CVE: CVE-2023-32366
Published: 2024-01-10
Description: An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4. Processing a font file may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213673; https://support.apple.com/en-us/HT213675
CVE: CVE-2023-32378
Published: 2024-01-10
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13.3, macOS Big Sur 11.7.5, macOS Monterey 12.6.4. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213675; https://support.apple.com/en-us/HT213677
CVE: CVE-2023-32383
Published: 2024-01-10
Description: This issue was addressed by forcing hardened runtime on the affected binaries at the system level. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. An app may be able to inject code into sensitive binaries bundled with Xcode.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213759; https://support.apple.com/en-us/HT213760
CVE: CVE-2023-32401
Published: 2024-01-10
Description: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.6.6, macOS Big Sur 11.7.7, macOS Ventura 13.4. Parsing an office document may lead to an unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://support.apple.com/en-us/HT213758; https://support.apple.com/en-us/HT213759; https://support.apple.com/en-us/HT213760
CVE: CVE-2023-32424
Published: 2024-01-10
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.4 and iPadOS 16.4, watchOS 9.4. An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213676; https://support.apple.com/en-us/HT213678; https://support.apple.com/en-us/HT213676
CVE: CVE-2023-32436
Published: 2024-01-10
Description: The issue was addressed with improved bounds checks. This issue is fixed in macOS Ventura 13.3. An app may be able to cause unexpected system termination or write kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-38607
Published: 2024-01-10
Description: The issue was addressed with improved handling of caches. This issue is fixed in macOS Sonoma 14. An app may be able to modify Printer settings.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-38610
Published: 2024-01-10
Description: A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An app may be able to cause unexpected system termination or write kernel memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213938
CVE: CVE-2023-38612
Published: 2024-01-10
Description: The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, iOS 17 and iPadOS 17, macOS Sonoma 14, macOS Ventura 13.6. An app may be able to access protected user data.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/HT213927; https://support.apple.com/en-us/HT213931; https://support.apple.com/en-us/HT213932
CVE: CVE-2023-40383
Published: 2024-01-10
Description: A path handling issue was addressed with improved validation. This issue is fixed in macOS Ventura 13.3. An app may be able to access user-sensitive data.
CVSS Score: 3.3 (LOW)
CWE: CWE-22
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670
CVE: CVE-2023-40385
Published: 2024-01-10
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, Safari 17, iOS 17 and iPadOS 17. A remote attacker may be able to view leaked DNS queries with Private Relay turned on.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213938; https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213941
CVE: CVE-2023-40393
Published: 2024-01-10
Description: An authentication issue was addressed with improved state management. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. Photos in the Hidden Photos Album may be viewed without authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-306, CWE-306
References: https://support.apple.com/en-us/120949; https://support.apple.com/en-us/120950; https://support.apple.com/en-us/HT213940
CVE: CVE-2023-40394
Published: 2024-01-10
Description: The issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.6 and iPadOS 16.6. An app may be able to access sensitive user data.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://support.apple.com/en-us/HT213841; https://support.apple.com/en-us/HT213841
CVE: CVE-2023-40411
Published: 2024-01-10
Description: This issue was addressed with improved data protection. This issue is fixed in macOS Sonoma 14. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-40414
Published: 2024-01-10
Description: A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 10, iOS 17 and iPadOS 17, tvOS 17, macOS Sonoma 14, Safari 17. Processing web content may lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416, CWE-416
References: http://www.openwall.com/lists/oss-security/2024/02/05/8; https://support.apple.com/en-us/HT213936; https://support.apple.com/en-us/HT213937
CVE: CVE-2023-40430
Published: 2024-01-10
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access removable volumes without user consent.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-285
References: https://support.apple.com/en-us/HT213940; https://support.apple.com/en-us/HT213940; https://support.apple.com/kb/HT213940
CVE: CVE-2023-40433
Published: 2024-01-10
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213670; https://support.apple.com/en-us/HT213670