deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-50308
Published: 2024-01-22
Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a denial of service when a statement is run on columnar tables.  IBM X-Force ID:  273393.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/273393; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7105506
CVE: CVE-2024-0430
Published: 2024-01-22
Description: IObit Malware Fighter v11.0.0.1274 is vulnerable to a Denial of Service vulnerability by triggering the 0x8001E00C IOCTL code of the ImfHpRegFilter.sys driver.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://fluidattacks.com/advisories/davis/; https://www.iobit.com/en/malware-fighter.php; https://fluidattacks.com/advisories/davis/
CVE: CVE-2024-0605
Published: 2024-01-22
Description: Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. This bypasses security measures, potentially leading to arbitrary code execution or unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362, CWE-362
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1855575; https://www.mozilla.org/security/advisories/mfsa2024-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1855575
CVE: CVE-2024-0606
Published: 2024-01-22
Description: An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://bugzilla.mozilla.org/show_bug.cgi?id=1855030; https://www.mozilla.org/security/advisories/mfsa2024-03/; https://bugzilla.mozilla.org/show_bug.cgi?id=1855030
CVE: CVE-2023-27859
Published: 2024-01-22
Description: IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases.  A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file in another database.  IBM X-Force ID:  249205.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-427
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/249205; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7105503
CVE: CVE-2023-47152
Published: 2024-01-22
Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-209
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7105605; https://exchange.xforce.ibmcloud.com/vulnerabilities/270730
CVE: CVE-2023-47158
Published: 2024-01-22
Description: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 

10.5, 11.1 and 11.5

 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query.  IBM X-Force ID:  270750.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270750; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7105496
CVE: CVE-2023-47747
Published: 2024-01-22
Description: IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query.  IBM X-Force ID:  272646.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/272646; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7105502
CVE: CVE-2023-6290
Published: 2024-01-22
Description: The SEOPress WordPress plugin before 7.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/78a13958-cd12-4ea8-b326-1e3184da970b/; https://wpscan.com/vulnerability/78a13958-cd12-4ea8-b326-1e3184da970b/
CVE: CVE-2023-6384
Published: 2024-01-22
Description: The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arbitrary avatar
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-639
References: https://wpscan.com/vulnerability/fbdefab4-614b-493b-a9ae-c5aeff8323ef/; https://wpscan.com/vulnerability/fbdefab4-614b-493b-a9ae-c5aeff8323ef/
CVE: CVE-2023-6447
Published: 2024-01-22
Description: The EventPrime WordPress plugin before 3.3.6 lacks authentication and authorization, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id/event name.
CVSS Score: 5.3 (MEDIUM)
References: https://wpscan.com/vulnerability/e366881c-d21e-4063-a945-95e6b080a373/; https://wpscan.com/vulnerability/e366881c-d21e-4063-a945-95e6b080a373/
CVE: CVE-2023-6456
Published: 2024-01-22
Description: The WP Review Slider WordPress plugin before 13.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/30f31412-8f94-4d5e-a080-3f6f669703cd/; https://wpscan.com/vulnerability/30f31412-8f94-4d5e-a080-3f6f669703cd/
CVE: CVE-2023-6625
Published: 2024-01-22
Description: The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f/; https://wpscan.com/vulnerability/d483f7ce-cb3f-4fcb-b060-005cec0ea10f/
CVE: CVE-2023-6626
Published: 2024-01-22
Description: The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/327ae124-79eb-4e07-b029-e4f543cbd356/; https://wpscan.com/vulnerability/327ae124-79eb-4e07-b029-e4f543cbd356/
CVE: CVE-2023-7082
Published: 2024-01-22
Description: The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip file into a publicly accessible directory without sufficiently validating the extracted file type. This may allows high privilege users such as administrator to upload an executable file type leading to remote code execution.
CVSS Score: 7.2 (HIGH)
References: https://wpscan.com/vulnerability/7f947305-7a72-4c59-9ae8-193f437fd04e/; https://wpscan.com/vulnerability/7f947305-7a72-4c59-9ae8-193f437fd04e/
CVE: CVE-2023-7170
Published: 2024-01-22
Description: The EventON-RSVP WordPress plugin before 2.9.5 does not sanitise and escape some parameters before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/218fb3af-3a40-486f-8ea9-80211a986fb3/; https://wpscan.com/vulnerability/218fb3af-3a40-486f-8ea9-80211a986fb3/
CVE: CVE-2023-7194
Published: 2024-01-22
Description: The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/e20292af-939a-4cb1-91e4-5ff6aa0c7fbe; https://wpscan.com/vulnerability/e20292af-939a-4cb1-91e4-5ff6aa0c7fbe
CVE: CVE-2023-24135
Published: 2024-01-22
Description: Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the function formWriteFacMac. This vulnerability allows attackers to execute arbitrary commands via manipulation of the mac parameter.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77, CWE-77
References: http://eagle.com; http://jensen.com; https://oxnan.com/img/Pasted%20image%[PII_REDACTED].png
CVE: CVE-2023-47141
Published: 2024-01-22
Description: IIBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query.  IBM X-Force ID:  270264.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/270264; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://www.ibm.com/support/pages/node/7105497
CVE: CVE-2024-23675
Published: 2024-01-22
Description: In Splunk Enterprise versions below 9.0.8 and 9.1.3, Splunk app key value store (KV Store) improperly handles permissions for users that use the REST application programming interface (API). This can potentially result in the deletion of KV Store collections.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-863
References: https://advisory.splunk.com/advisories/SVD-2024-0105; https://research.splunk.com/application/8f0e8380-a835-4f2b-b749-9ce119364df0/; https://advisory.splunk.com/advisories/SVD-2024-0105
CVE: CVE-2024-23676
Published: 2024-01-22
Description: In Splunk versions below 9.0.8 and 9.1.3, the “mrollup” SPL command lets a low-privileged user view metrics on an index that they do not have permission to view. This vulnerability requires user interaction from a high-privileged user to exploit.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: https://advisory.splunk.com/advisories/SVD-2024-0106; https://research.splunk.com/application/ee69374a-d27e-4136-adac-956a96ff60fd/; https://advisory.splunk.com/advisories/SVD-2024-0106
CVE: CVE-2024-23677
Published: 2024-01-22
Description: In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-532, CWE-532
References: https://advisory.splunk.com/advisories/SVD-2024-0107; https://advisory.splunk.com/advisories/SVD-2024-0107
CVE: CVE-2024-23678
Published: 2024-01-22
Description: In Splunk Enterprise for Windows versions below 9.0.8 and 9.1.3, Splunk Enterprise does not correctly sanitize path input data. This results in the unsafe deserialization of untrusted data from a separate disk partition on the machine. This vulnerability only affects Splunk Enterprise for Windows.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://advisory.splunk.com/advisories/SVD-2024-0108; https://research.splunk.com/application/947d4d2e-1b64-41fc-b32a-736ddb88ce97/; https://advisory.splunk.com/advisories/SVD-2024-0108
CVE: CVE-2021-42141
Published: 2024-01-22
Description: An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in the packets Client_Hello, Client_key_exchange, and Change_cipher_spec, which may cause denial of service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755, CWE-755
References: http://packetstormsecurity.com/files/176625/Contiki-NG-tinyDTLS-Denial-Of-Service.html; https://github.com/contiki-ng/tinydtls/issues/27; https://seclists.org/fulldisclosure/2024/Jan/14
CVE: CVE-2024-23339
Published: 2024-01-22
Description: hoolock is a suite of lightweight utilities designed to maintain a small footprint when bundled. Starting in version 2.0.0 and prior to version 2.2.1, utility functions related to object paths (`get`, `set`, and `update`) did not block attempts to access or alter object prototypes. Starting in version 2.2.1, the `get`, `set` and `update` functions throw a `TypeError` when a user attempts to access or alter inherited properties.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-1321
References: https://github.com/elijahharry/hoolock/commit/97ae80e856774335d92743c635ffeae2f652b982; https://github.com/elijahharry/hoolock/security/advisories/GHSA-4c2g-hx49-7h25; https://github.com/elijahharry/hoolock/commit/97ae80e856774335d92743c635ffeae2f652b982
CVE: CVE-2024-23340
Published: 2024-01-22
Description: @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.


CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/honojs/node-server/blob/8cea466fd05e6d2e99c28011fc0e2c2d3f3397c9/src/request.ts#L43-L45; https://github.com/honojs/node-server/commit/dd9b9a9b23e3896403c90a740e7f1f0892feb402; https://github.com/honojs/node-server/security/advisories/GHSA-rjq5-w47x-x359
CVE: CVE-2024-23342
Published: 2024-01-23
Description: The `ecdsa` PyPI package is a pure Python implementation of ECC (Elliptic Curve Cryptography) with support for ECDSA (Elliptic Curve Digital Signature Algorithm), EdDSA (Edwards-curve Digital Signature Algorithm) and ECDH (Elliptic Curve Diffie-Hellman). Versions 0.18.0 and prior are vulnerable to the Minerva attack. As of time of publication, no known patched version exists.
CVSS Score: 7.4 (HIGH)
CWE: CWE-203, CWE-208, CWE-385
References: https://github.com/tlsfuzzer/python-ecdsa/blob/master/SECURITY.md; https://github.com/tlsfuzzer/python-ecdsa/security/advisories/GHSA-wj6h-64fc-37mp; https://minerva.crocs.fi.muni.cz/
CVE: CVE-2024-23345
Published: 2024-01-23
Description: Nautobot is a Network Source of Truth and Network Automation Platform built as a web application.  All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://github.com/nautobot/nautobot/commit/17effcbe84a72150c82b138565c311bbee357e80; https://github.com/nautobot/nautobot/commit/64312a4297b5ca49b6cdedf477e41e8e4fd61cce; https://github.com/nautobot/nautobot/pull/5133
CVE: CVE-2023-40528
Published: 2024-01-23
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://seclists.org/fulldisclosure/2024/Jan/37; https://support.apple.com/en-us/HT213936; https://support.apple.com/en-us/HT213937
CVE: CVE-2023-42881
Published: 2024-01-23
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing a file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214036; https://support.apple.com/kb/HT214036
CVE: CVE-2023-42887
Published: 2024-01-23
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS Sonoma 14.2. An app may be able to read arbitrary files.
CVSS Score: 6.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2024/Jan/37; https://support.apple.com/en-us/HT214036; https://support.apple.com/en-us/HT214058
CVE: CVE-2023-42888
Published: 2024-01-23
Description: The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. Processing a maliciously crafted image may result in disclosure of process memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2024/Jan/34; http://seclists.org/fulldisclosure/2024/Jan/37; http://seclists.org/fulldisclosure/2024/Jan/38
CVE: CVE-2023-42915
Published: 2024-01-23
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-42935
Published: 2024-01-23
Description: An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the previous logged in user’s desktop from the fast user switching screen.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2024/Jan/37; https://support.apple.com/en-us/HT214058; https://support.apple.com/kb/HT213984
CVE: CVE-2023-42937
Published: 2024-01-23
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-532
References: http://seclists.org/fulldisclosure/2024/Jan/34; http://seclists.org/fulldisclosure/2024/Jan/37; http://seclists.org/fulldisclosure/2024/Jan/38
CVE: CVE-2024-23203
Published: 2024-01-23
Description: The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.5. A shortcut may be able to use sensitive data with certain actions without prompting the user.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120309; https://support.apple.com/en-us/120880
CVE: CVE-2024-23204
Published: 2024-01-23
Description: The issue was addressed with additional permissions checks. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, watchOS 10.3. A shortcut may be able to use sensitive data with certain actions without prompting the user.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120306; https://support.apple.com/en-us/120309
CVE: CVE-2024-23206
Published: 2024-01-23
Description: An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A maliciously crafted webpage may be able to fingerprint the user.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120306; https://support.apple.com/en-us/120309
CVE: CVE-2024-23207
Published: 2024-01-23
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, watchOS 10.3. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120305; https://support.apple.com/en-us/120306
CVE: CVE-2024-23208
Published: 2024-01-23
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-94
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120306; https://support.apple.com/en-us/120309
CVE: CVE-2024-23209
Published: 2024-01-23
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
References: https://support.apple.com/en-us/120309; http://seclists.org/fulldisclosure/2024/Jan/36; https://support.apple.com/en-us/HT214061
CVE: CVE-2024-23210
Published: 2024-01-23
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may be able to view a user's phone number in system logs.
CVSS Score: 3.3 (LOW)
CWE: CWE-532
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120306; https://support.apple.com/en-us/120309
CVE: CVE-2024-23211
Published: 2024-01-23
Description: A privacy issue was addressed with improved handling of user preferences. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, watchOS 10.3. A user's private browsing activity may be visible in Settings.
CVSS Score: 3.3 (LOW)
CWE: CWE-359
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120306; https://support.apple.com/en-us/120309
CVE: CVE-2024-23212
Published: 2024-01-23
Description: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3, watchOS 10.3. An app may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120305; https://support.apple.com/en-us/120306
CVE: CVE-2024-23213
Published: 2024-01-23
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120306; https://support.apple.com/en-us/120309
CVE: CVE-2024-23214
Published: 2024-01-23
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120309; https://support.apple.com/en-us/120310
CVE: CVE-2024-23215
Published: 2024-01-23
Description: An issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/120304; https://support.apple.com/en-us/120306; https://support.apple.com/en-us/120309