deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-3009
Published: 2025-03-31
Description: A vulnerability classified as critical was found in Jinher Network OA C6. Affected by this vulnerability is an unknown functionality of the file /C6/JHSoft.Web.NetDisk/NetDiskProperty.aspx. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89
References: https://github.com/Myoung-SA/cve/issues/1; https://vuldb.com/?ctiid.302059; https://vuldb.com/?id.302059
CVE: CVE-2025-3010
Published: 2025-03-31
Description: A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermediate::isConversionAllowed of the file glslang/MachineIndependent/Intermediate.cpp. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
CVSS Score: 3.3 (LOW)
CWE: CWE-404, CWE-476
References: https://github.com/KhronosGroup/glslang/issues/3903; https://github.com/KhronosGroup/glslang/issues/3903#issue[PII_REDACTED]; https://vuldb.com/?ctiid.302060
CVE: CVE-2024-24456
Published: 2025-03-31
Description: An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer overflow.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-120
References: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04780en_us&docLocale=en_US
CVE: CVE-2024-54802
Published: 2025-03-31
Description: In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Host header.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#802
CVE: CVE-2024-54803
Published: 2025-03-31
Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter pppoe_peer_mac and forcing a reboot. This will result in command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#803
CVE: CVE-2024-54804
Published: 2025-03-31
Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter wan_hostname and forcing a reboot. This will result in command injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#804
CVE: CVE-2024-54805
Published: 2025-03-31
Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. An attacker can send a specially crafted request to post.cgi, updating the nvram parameter get_email. After which, they can visit the send_log.cgi endpoint which uses the parameter in a system call to achieve command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#805
CVE: CVE-2024-54806
Published: 2025-03-31
Description: Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system commands via the web interface.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#806
CVE: CVE-2024-54807
Published: 2025-03-31
Description: In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the NewInternalClient parameter of the AddPortMapping SOAPAction into a system call without sanitation. An attacker can send a specially crafted SOAPAction request for AddPortMapping via the router's WANIPConn1 service to achieve arbitrary command execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#807
CVE: CVE-2024-54808
Published: 2025-03-31
Description: Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due to an unconstrained use of sscanf. The vulnerability allows for control of the program counter and can be utilized to achieve arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#808
CVE: CVE-2024-54809
Published: 2025-03-31
Description: Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of a request header parameter in a strncpy where size is determined based on the input specified. By sending a specially crafted packet, an attacker can take control of the program counter and hijack control flow of the program to execute arbitrary system commands.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#809
CVE: CVE-2025-3015
Published: 2025-03-31
Description: A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepresentation of the file code/AssetLib/ASE/ASELoader.cpp of the component ASE File Handler. The manipulation of the argument mIndices leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.0 is able to address this issue. The patch is named 7c705fde418d68cca4e8eff56be01b2617b0d6fe. It is recommended to apply a patch to fix this issue.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119, CWE-125, CWE-125
References: https://github.com/assimp/assimp/commit/7c705fde418d68cca4e8eff56be01b2617b0d6fe; https://github.com/assimp/assimp/issues/6021; https://github.com/assimp/assimp/issues/6021#issue[PII_REDACTED]
CVE: CVE-2025-3016
Published: 2025-03-31
Description: A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::ParseTextureColorData of the file code/AssetLib/MDL/MDLMaterialLoader.cpp of the component MDL File Handler. The manipulation of the argument mWidth/mHeight leads to resource consumption. The attack can be initiated remotely. Upgrading to version 6.0 is able to address this issue. The name of the patch is 5d2a7482312db2e866439a8c05a07ce1e718bed1. It is recommended to apply a patch to fix this issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-400, CWE-404, CWE-404
References: https://github.com/assimp/assimp/commit/5d2a7482312db2e866439a8c05a07ce1e718bed1; https://github.com/assimp/assimp/issues/6022; https://github.com/assimp/assimp/pull/6046
CVE: CVE-2025-26683
Published: 2025-03-31
Description: Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26683
CVE: CVE-2025-31673
Published: 2025-03-31
Description: Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://www.drupal.org/sa-core-2025-002
CVE: CVE-2025-31674
Published: 2025-03-31
Description: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVSS Score: 7.5 (HIGH)
CWE: CWE-915, CWE-913
References: https://www.drupal.org/sa-core-2025-003
CVE: CVE-2025-31675
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.14, from 10.4.0 before 10.4.5, from 11.0.0 before 11.0.13, from 11.1.0 before 11.1.5. It also affects the Drupal 7 module from versions 7.x-1.0 through 7.x-1.12.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://d7es.tag1.com/security-advisories/link-moderately-critical-cross-site-scripting-sa-core-2025-004; https://www.drupal.org/sa-core-2025-004; https://www.herodevs.com/vulnerability-directory/cve-2025-31675
CVE: CVE-2025-31676
Published: 2025-03-31
Description: Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1390, CWE-307
References: https://www.drupal.org/sa-contrib-2025-001
CVE: CVE-2025-31677
Published: 2025-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Intelligence): from 1.0.0 before 1.0.2.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352, CWE-352
References: https://www.drupal.org/sa-contrib-2025-003
CVE: CVE-2025-31678
Published: 2025-03-31
Description: Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-862
References: https://www.drupal.org/sa-contrib-2025-004
CVE: CVE-2025-31679
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (XSS).This issue affects Ignition Error Pages: from 0.0.0 before 1.0.4.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-contrib-2025-007
CVE: CVE-2025-31680
Published: 2025-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 before 1.24.0.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.drupal.org/sa-contrib-2025-008
CVE: CVE-2025-31681
Published: 2025-03-31
Description: Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://www.drupal.org/sa-contrib-2025-009
CVE: CVE-2025-31682
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-contrib-2025-011
CVE: CVE-2025-31683
Published: 2025-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352, CWE-352
References: https://www.drupal.org/sa-contrib-2025-012
CVE: CVE-2025-31684
Published: 2025-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4.1.3.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2025-013
CVE: CVE-2025-31685
Published: 2025-03-31
Description: Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-014
CVE: CVE-2025-31686
Published: 2025-03-31
Description: Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-015
CVE: CVE-2025-31687
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS).This issue affects SpamSpan filter: from 0.0.0 before 3.2.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-016
CVE: CVE-2025-31688
Published: 2025-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0.0.0 before 1.10.0, from 2.0.0 before 2.0.2.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2025-017
CVE: CVE-2025-31689
Published: 2025-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data Protection Regulation: from 0.0.0 before 3.0.1, from 3.1.0 before 3.1.2.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2025-018
CVE: CVE-2025-31690
Published: 2025-03-31
Description: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://www.drupal.org/sa-contrib-2025-019
CVE: CVE-2025-31691
Published: 2025-03-31
Description: Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://www.drupal.org/sa-contrib-2025-020
CVE: CVE-2025-31692
Published: 2025-03-31
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://www.drupal.org/sa-contrib-2025-021
CVE: CVE-2025-31693
Published: 2025-03-31
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Command Injection.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.5.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://www.drupal.org/sa-contrib-2025-022
CVE: CVE-2025-31694
Published: 2025-03-31
Description: Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
CVSS Score: 8.1 (HIGH)
CWE: CWE-288
References: https://www.drupal.org/sa-contrib-2025-023
CVE: CVE-2025-31695
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting (XSS).This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-024
CVE: CVE-2025-31696
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scripting (XSS).This issue affects RapiDoc OAS Field Formatter: from 0.0.0 before 1.0.1.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-025
CVE: CVE-2025-31697
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS).This issue affects Formatter Suite: from 0.0.0 before 2.1.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.drupal.org/sa-contrib-2025-026
CVE: CVE-2025-3017
Published: 2025-03-31
Description: A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of the file src/tools/ta_regtest/ta_test_func/test_minmax.c of the component ta_regtest. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 5879180e9070ec35d52948f2f[PII_REDACTED]6a0f1. It is recommended to apply a patch to fix this issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-119, CWE-787
References: https://github.com/TA-Lib/ta-lib/commit/5879180e9070ec35d52948f2f[PII_REDACTED]6a0f1; https://github.com/TA-Lib/ta-lib/issues/61; https://github.com/TA-Lib/ta-lib/issues/61#issue[PII_REDACTED]
CVE: CVE-2025-3018
Published: 2025-03-31
Description: A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Users.php?f=delete. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/csemfl/cve/blob/main/sql.md; https://vuldb.com/?ctiid.302070; https://vuldb.com/?id.302070
CVE: CVE-2025-3036
Published: 2025-03-31
Description: A vulnerability, which was classified as problematic, was found in yzk[PII_REDACTED] StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a4831206f2714b21820f991. This affects an unknown part of the component Student Management Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.
CVSS Score: 2.4 (LOW)
CWE: CWE-79, CWE-94, CWE-79
References: https://github.com/yzk[PII_REDACTED]/StudentServlet-JSP/issues/2; https://github.com/yzk[PII_REDACTED]/StudentServlet-JSP/issues/2#issue[PII_REDACTED]; https://vuldb.com/?ctiid.302097
CVE: CVE-2025-3057
Published: 2025-03-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.drupal.org/sa-core-2025-001
CVE: CVE-2024-40864
Published: 2025-03-31
Description: The issue was addressed with improved handling of protocols. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.2, watchOS 11.2. An attacker in a privileged network position may be able to track a user's activity.
CVSS Score: 2.7 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/121837; https://support.apple.com/en-us/121839; https://support.apple.com/en-us/121843
CVE: CVE-2024-54533
Published: 2025-03-31
Description: A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access sensitive user data.
CVSS Score: 7.0 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/121839; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-24095
Published: 2025-03-31
Description: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4. An app may be able to bypass Privacy preferences.
CVSS Score: 7.6 (HIGH)
CWE: CWE-288
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122378; http://seclists.org/fulldisclosure/2025/Apr/12
CVE: CVE-2025-24097
Published: 2025-03-31
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, tvOS 18.4, watchOS 11.4. An app may be able to read arbitrary file metadata.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374
CVE: CVE-2025-24148
Published: 2025-03-31
Description: This issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious JAR file may bypass Gatekeeper checks.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-354
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-24157
Published: 2025-03-31
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to cause unexpected system termination or corrupt kernel memory.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-120
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-24164
Published: 2025-03-31
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-24167
Published: 2025-03-31
Description: This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A download's origin may be incorrectly associated.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122376
CVE: CVE-2025-24170
Published: 2025-03-31
Description: A logic issue was addressed with improved file handling. This issue is fixed in macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375; http://seclists.org/fulldisclosure/2025/Apr/10
CVE: CVE-2025-24172
Published: 2025-03-31
Description: A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. "Block All Remote Content" may not apply for all mail previews.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-276
References: https://support.apple.com/en-us/122373; https://support.apple.com/en-us/122374; https://support.apple.com/en-us/122375
CVE: CVE-2025-24173
Published: 2025-03-31
Description: This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to break out of its sandbox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://support.apple.com/en-us/122371; https://support.apple.com/en-us/122372; https://support.apple.com/en-us/122373