deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-28065
Published: 2023-06-23
Description: 
Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability leading to privilege escalation.


CVSS Score: 6.7 (MEDIUM)
CWE: CWE-1386, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000212574/dsa-2023-146; https://www.dell.com/support/kbdoc/en-us/000212574/dsa-2023-146
CVE: CVE-2023-29860
Published: 2023-06-23
Description: An insecure permissions in /Taier/API/tenant/listTenant interface in DTStack Taier 1.3.0 allows attackers to view sensitive information via the getCookie method.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://github.com/DTStack/Taier/issues/1003; https://github.com/DTStack/Taier/issues/1003
CVE: CVE-2023-30258
Published: 2023-06-23
Description: Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-77
References: http://packetstormsecurity.com/files/175672/MagnusBilling-Remote-Command-Execution.html; https://eldstal.se/advisories/230327-magnusbilling.html; https://github.com/MarkLee131/awesome-web-pocs/blob/main/CVE-2023-30258.md
CVE: CVE-2023-30260
Published: 2023-06-23
Description: Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.
CVSS Score: 8.8 (HIGH)
CWE: CWE-77
References: https://eldstal.se/advisories/230328-raspap.html; https://github.com/RaspAP/raspap-webgui/pull/1322; https://eldstal.se/advisories/230328-raspap.html
CVE: CVE-2023-30362
Published: 2023-06-23
Description: Buffer Overflow vulnerability in coap_send function in libcoap library 4.3.1-103-g52cfd56 fixed in 4.3.1-120-ge242200 allows attackers to obtain sensitive information via malformed pdu.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/obgm/libcoap/issues/1063; https://github.com/obgm/libcoap/pull/1065; https://github.com/obgm/libcoap/issues/1063
CVE: CVE-2023-34012
Published: 2023-06-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premium Addons for Elementor Premium Addons PRO plugin <= 2.8.24 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/premium-addons-pro/wordpress-premium-addons-pro-plugin-2-8-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/premium-addons-pro/wordpress-premium-addons-pro-plugin-2-8-24-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-34021
Published: 2023-06-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.29 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-3-7-29-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/church-admin/wordpress-church-admin-plugin-3-7-29-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-35048
Published: 2023-06-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MagePeople Team Booking and Rental Manager for Bike plugin <= 1.2.1 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://patchstack.com/database/vulnerability/booking-and-rental-manager-for-woocommerce/wordpress-booking-and-rental-manager-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/booking-and-rental-manager-for-woocommerce/wordpress-booking-and-rental-manager-plugin-1-2-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-27427
Published: 2023-06-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NTZApps CRM Memberships plugin <= 1.6 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/crm-memberships/wordpress-crm-memberships-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/crm-memberships/wordpress-crm-memberships-plugin-1-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-28751
Published: 2023-06-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-ultimate-review/wordpress-wp-ultimate-review-plugin-2-0-3-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-29100
Published: 2023-06-23
Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Dream-Theme The7 plugin <= 11.6.0 versions.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/dt-the7/wordpress-the7-theme-11-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/dt-the7/wordpress-the7-theme-11-6-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-32580
Published: 2023-06-23
Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPExperts Password Protected plugin <= 2.6.2 versions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/vulnerability/password-protected/wordpress-password-protected-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/password-protected/wordpress-password-protected-plugin-2-6-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2023-3302
Published: 2023-06-23
Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository admidio/admidio prior to 4.2.9.
CVSS Score: 7.8 (HIGH)
CWE: CWE-1236
References: https://github.com/admidio/admidio/commit/c87a7074a1a73c[PII_REDACTED]afd76aa4d5b6415f; https://huntr.dev/bounties/5e18619f-8379-464a-aad2-65883bb4e81a; https://github.com/admidio/admidio/commit/c87a7074a1a73c[PII_REDACTED]afd76aa4d5b6415f
CVE: CVE-2023-3303
Published: 2023-06-23
Description: Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
CVSS Score: 3.5 (LOW)
CWE: CWE-284
References: https://github.com/admidio/admidio/commit/3d8bafaa4e9b7a314ffdf548622a8c7b38faee8a; https://huntr.dev/bounties/65d260cc-55a9-4e71-888d-cb2f66c071af; https://github.com/admidio/admidio/commit/3d8bafaa4e9b7a314ffdf548622a8c7b38faee8a
CVE: CVE-2023-3304
Published: 2023-06-23
Description: Improper Access Control in GitHub repository admidio/admidio prior to 4.2.9.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: https://github.com/admidio/admidio/commit/3b248b7d5e0e60a00ee2f9a6908d538d62a5837f; https://huntr.dev/bounties/721fae61-3c8c-4e4b-8407-64321bc0ed17; https://github.com/admidio/admidio/commit/3b248b7d5e0e60a00ee2f9a6908d538d62a5837f
CVE: CVE-2022-47614
Published: 2023-06-23
Description: Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/mstore-api/wordpress-mstore-api-plugin-3-9-7-sql-injection?_s_id=cve; https://patchstack.com/database/vulnerability/mstore-api/wordpress-mstore-api-plugin-3-9-7-sql-injection?_s_id=cve
CVE: CVE-2023-23679
Published: 2023-06-23
Description: Authorization Bypass Through User-Controlled Key vulnerability in JS Help Desk js-support-ticket allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JS Help Desk: from n/a through 2.7.7.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-639
References: https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-best-help-desk-support-plugin-plugin-2-7-7-idor-leading-to-ticket-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/js-support-ticket/wordpress-js-help-desk-best-help-desk-support-plugin-plugin-2-7-7-idor-leading-to-ticket-deletion-vulnerability?_s_id=cve
CVE: CVE-2023-34464
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.2.1 until versions 14.4.8, 14.10.5, and 15.1RC1 of org.xwiki.platform:xwiki-platform-web and any version prior to 14.4.8, 14.10.5, and 15.1.RC1 of org.xwiki.platform:xwiki-platform-web-templates, any user who can edit a document in a wiki like the user profile can create a stored cross-site scripting attack. The attack occurs by putting plain HTML code into that document and then tricking another user to visit that document with the `displaycontent` or `rendercontent` template and plain output syntax. If a user with programming rights is tricked into visiting such a URL, arbitrary actions be performed with this user's rights, impacting the confidentiality, integrity, and availability of the whole XWiki installation. This has been patched in XWiki 14.4.8, 14.10.5 and 15.1RC1 by setting the content type of the response to plain text when the output syntax is not an HTML syntax.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-79
References: https://github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6df; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-fp7h-f9f5-x4q7; https://jira.xwiki.org/browse/XWIKI-20290
CVE: CVE-2023-36271
Published: 2023-06-23
Description: LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_wcs2nlen at bits.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/blob/0.10/src/bits.c#L1677C11-L1683C17; https://github.com/LibreDWG/libredwg/commit/c1ed1d91e28a6ddc7a9b5479d4795d58fb6be0ca; https://github.com/LibreDWG/libredwg/issues/681#BUG2
CVE: CVE-2023-36272
Published: 2023-06-23
Description: LibreDWG v0.10 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_utf8_to_TU at bits.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://github.com/LibreDWG/libredwg/blob/0.10/src/bits.c#L1677C11-L1683C17; https://github.com/LibreDWG/libredwg/commit/c1ed1d91e28a6ddc7a9b5479d4795d58fb6be0ca; https://github.com/LibreDWG/libredwg/issues/681#BUG1
CVE: CVE-2023-36273
Published: 2023-06-23
Description: LibreDWG v0.12.5 was discovered to contain a heap buffer overflow via the function bit_calc_CRC at bits.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/issues/677#BUG1; https://github.com/LibreDWG/libredwg/issues/677#BUG1
CVE: CVE-2023-36274
Published: 2023-06-23
Description: LibreDWG v0.11 to v0.12.5 was discovered to contain a heap buffer overflow via the function bit_write_TF at bits.c.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/LibreDWG/libredwg/blob/0.11/src/out_dxf.c#L1792; https://github.com/LibreDWG/libredwg/commit/8651fa27dd2de731e706e2ba09f0d28e4e0dce33; https://github.com/LibreDWG/libredwg/issues/677#BUG2
CVE: CVE-2023-36288
Published: 2023-06-23
Description: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via GET configure parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-admin-dashboard-via-configure-parameter-in-QloApps-1-6-0-b6303661ac6a47e4b7a6f23cf2818a52?pvs=4; https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-admin-dashboard-via-configure-parameter-in-QloApps-1-6-0-b6303661ac6a47e4b7a6f23cf2818a52?pvs=4
CVE: CVE-2023-36289
Published: 2023-06-23
Description: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST email_create and back parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-POST-Request-via-email_create-and-back-parameter-in-QloApps-1-6-0-e05548203d744daf9047d82fc94b19b7?pvs=4; https://flashy-lemonade-192.notion.site/Cross-site-scripting-in-POST-Request-via-email_create-and-back-parameter-in-QloApps-1-6-0-e05548203d744daf9047d82fc94b19b7?pvs=4
CVE: CVE-2023-34465
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform. Starting in version 11.8-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.2, `Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can change the mail obfuscation configuration and view and edit the mail sending configuration, including the smtp domain name and credentials. The problem has been patched in XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, the rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-269
References: https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc[PII_REDACTED]d1; https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-g75c-cjr6-39mc
CVE: CVE-2023-34466
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.0-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, tags from pages not viewable to the current user are leaked by the tags API. This information can also be exploited to infer the document reference of non-viewable pages. This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.


CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7; https://jira.xwiki.org/browse/XWIKI-20002; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7f2f-pcv3-j2r7
CVE: CVE-2023-35925
Published: 2023-06-23
Description: FastAsyncWorldEdit (FAWE) is designed for efficient world editing. This vulnerability enables the attacker to select a region with the `Infinity` keyword (case-sensitive!) and executes any operation. This has a possibility of bringing the performing server down. This issue has been fixed in version 2.6.3.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-400, CWE-400
References: https://github.com/IntellectualSites/FastAsyncWorldEdit/pull/2285; https://github.com/IntellectualSites/FastAsyncWorldEdit/releases/tag/2.6.3; https://github.com/IntellectualSites/FastAsyncWorldEdit/security/advisories/GHSA-whj9-m24x-qhhp
CVE: CVE-2023-36284
Published: 2023-06-23
Description: An unauthenticated Time-Based SQL injection found in Webkul QloApps 1.6.0 via GET parameter date_from, date_to, and id_product allows a remote attacker to bypass a web application's authentication and authorization mechanisms and retrieve the contents of an entire database.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://flashy-lemonade-192.notion.site/Time-Based-SQL-injection-in-QloApps-1-6-0-0-be3ed1bdaf784a77b45dc6898a2de17e?pvs=4; https://flashy-lemonade-192.notion.site/Time-Based-SQL-injection-in-QloApps-1-6-0-0-be3ed1bdaf784a77b45dc6898a2de17e?pvs=4
CVE: CVE-2023-36287
Published: 2023-06-23
Description: An unauthenticated Cross-Site Scripting (XSS) vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://flashy-lemonade-192.notion.site/Cross-site-scripting-via-controller-parameter-in-QloApps-1-6-0-97e409ce164f40d195b625b9bf719900?pvs=4; https://flashy-lemonade-192.notion.site/Cross-site-scripting-via-controller-parameter-in-QloApps-1-6-0-97e409ce164f40d195b625b9bf719900?pvs=4
CVE: CVE-2023-3391
Published: 2023-06-23
Description: A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file detailview.php. The manipulation of the argument employeeid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-232288.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/mohdkey/Human-Resource-Management-System/blob/main/Human%20Resource%20Management%20System%20detailview.php%20has%20Sqlinjection.pdf; https://vuldb.com/?ctiid.232288; https://vuldb.com/?id.232288
CVE: CVE-2023-34467
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform. Starting in version 3.5-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, the mail obfuscation configuration was not fully taken into account. While the mail displayed to the end user was obfuscated, the rest response was also containing the mail unobfuscated and users were able to filter and sort on the unobfuscated, allowing them to infer the mail content. The consequence was the possibility to retrieve the email addresses of all users even when obfuscated. This has been patched in XWiki 14.4.8, 14.10.4, and 15.0-rc-1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-402, CWE-668
References: https://github.com/xwiki/xwiki-platform/commit/71f889db9962df2d385f4298e29cfbc9050b828a#diff-5a739e5865b1f1ad9d79b724791be51b0095a0170cc078911c940478b13b949a; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-7vr7-cghh-ch63; https://jira.xwiki.org/browse/XWIKI-20333
CVE: CVE-2023-35150
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. The problem has been patched in XWiki 15.0, 14.10.4 and 14.4.8.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-6mf5-36v9-3h2w; https://jira.xwiki.org/browse/XWIKI-20285
CVE: CVE-2023-35151
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform. Starting in version 7.3-milestone-1 and prior to versions 14.4.8, 14.10.6, and 15.1, ny user can call a REST endpoint and obtain the obfuscated passwords, even when the mail obfuscation is activated. The issue has been patched in XWiki 14.4.8, 14.10.6, and 15.1. There is no known workaround.
CVSS Score: 7.5 (HIGH)
CWE: CWE-359, CWE-668
References: https://github.com/xwiki/xwiki-platform/commit/824cd742ecf[PII_REDACTED]da11bfe7e0ad2b10ede; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-8g9c-c9cm-9c56; https://jira.xwiki.org/browse/XWIKI-16138
CVE: CVE-2023-35152
Published: 2023-06-23
Description: XWiki Platform is a generic wiki platform. Starting in version 12.9-rc-1 and prior to versions 14.4.8, 14.10.6, and 15.1, any logged in user can add dangerous content in their first name field and see it executed with programming rights. Leading to rights escalation. The vulnerability has been fixed on XWiki 14.4.8, 14.10.6, and 15.1. As a workaround, one may apply the patch manually.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-95, CWE-94
References: https://github.com/xwiki/xwiki-platform/commit/0993a7ab3c102f9ac37ffe361a83a3dc302c0e45#diff-0b51114cb27f7a5c599cf40c59d658eae6ddc5c0836532c3b35e163f40a4854fR39; https://github.com/xwiki/xwiki-platform/commit/6ce2d04a5779e07f6d3ed3f37d4761049b4fc3ac#diff-ef7f8b911bb8e584fda22aac5876a329add35ca0d1d32e0fdb62a439b78cfa49; https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-rf8j-q39g-7xfm
CVE: CVE-2022-22630
Published: 2023-06-23
Description: A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.6.6, macOS Monterey 12.3, Security Update 2022-004 Catalina. A remote user may cause an unexpected app termination or arbitrary code execution
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-42792
Published: 2023-06-23
Description: This issue was addressed with improved data protection. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to read sensitive location information
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-203
References: https://support.apple.com/en-us/HT213489; https://support.apple.com/en-us/HT213489
CVE: CVE-2022-42807
Published: 2023-06-23
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. A user may accidentally add a participant to a Shared Album by pressing the Delete key
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-640
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213488
CVE: CVE-2022-42834
Published: 2023-06-23
Description: An access issue was addressed with improved access restrictions. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13, macOS Big Sur 11.7.3. An app may be able to access mail folder attachments through a temporary directory used during compression
CVSS Score: 3.3 (LOW)
CWE: CWE-552
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213603; https://support.apple.com/en-us/HT213604
CVE: CVE-2022-42860
Published: 2023-06-23
Description: This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1, macOS Ventura 13. An app may be able to modify protected parts of the file system
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://support.apple.com/en-us/HT213488; https://support.apple.com/en-us/HT213493; https://support.apple.com/en-us/HT213494
CVE: CVE-2022-46715
Published: 2023-06-23
Description: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to bypass certain Privacy preferences
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213489; https://support.apple.com/en-us/HT213489
CVE: CVE-2022-46718
Published: 2023-06-23
Description: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to read sensitive location information
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-346
References: https://support.apple.com/en-us/HT213531; https://support.apple.com/en-us/HT213532; https://support.apple.com/en-us/HT213533
CVE: CVE-2023-23516
Published: 2023-06-23
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213603; https://support.apple.com/en-us/HT213604; https://support.apple.com/en-us/HT213605
CVE: CVE-2023-23539
Published: 2023-06-23
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.apple.com/en-us/HT213605; https://support.apple.com/en-us/HT213605; https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1659