deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-49803
Published: 2023-12-11
Description: @koa/cors npm provides Cross-Origin Resource Sharing (CORS) for koa, a web framework for Node.js. Prior to version 5.0.0, the middleware operates in a way that if an allowed origin is not provided, it will return an `Access-Control-Allow-Origin` header with the value of the origin from the request. This behavior completely disables one of the most crucial elements of browsers - the Same Origin Policy (SOP), this could cause a very serious security threat to the users of this middleware. If such behavior is expected, for instance, when middleware is used exclusively for prototypes and not for production applications, it should be heavily emphasized in the documentation along with an indication of the risks associated with such behavior, as many users may not be aware of it. Version 5.0.0 fixes this vulnerability.
CVSS Score: 8.6 (HIGH)
CWE: CWE-346, CWE-346
References: https://github.com/koajs/cors/commit/f31dac99f5355c41e7d4dd3c4a80c5f154941a11; https://github.com/koajs/cors/security/advisories/GHSA-qxrj-hx23-xp82; https://github.com/koajs/cors/commit/f31dac99f5355c41e7d4dd3c4a80c5f154941a11
CVE: CVE-2023-49804
Published: 2023-12-11
Description: Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. This vulnerability allows unauthorized access to user accounts, compromising the security of sensitive information. The same vulnerability was partially fixed in  CVE-2023-44400, but logging existing users out of their accounts was forgotten. To mitigate the risks associated with this vulnerability, the maintainers made the server emit a `refresh` event (clients handle this by reloading) and then disconnecting all clients except the one initiating the password change. It is recommended to update Uptime Kuma to version 1.23.9.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-384
References: https://github.com/louislam/uptime-kuma/commit/482049c72b3a650c7bc5c26c2f4d57a21c0e0aa0; https://github.com/louislam/uptime-kuma/security/advisories/GHSA-88j4-pcx8-q4q3; https://github.com/louislam/uptime-kuma/security/advisories/GHSA-g9v2-wqcj-j99g
CVE: CVE-2023-49805
Published: 2023-12-11
Description: Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, the application uses WebSocket (with Socket.io), but it does not verify that the source of communication is valid. This allows third-party website to access the application on behalf of their client. When connecting to the server using Socket.IO, the server does not validate the `Origin` header leading to other site being able to open connections to the server and communicate with it. Other websites still need to authenticate to access most features, however this can be used to circumvent firewall protections made in place by people deploying the application.

Without origin validation, Javascript executed from another origin would be allowed to connect to the application without any user interaction. Without login credentials, such a connection is unable to access protected endpoints containing sensitive data of the application. However, such a connection may allow attacker to further exploit unseen vulnerabilities of the application. Users with "No-auth" mode configured who are relying on a reverse proxy or firewall to provide protection to the application would be especially vulnerable as it would grant the attacker full access to the application.

In version 1.23.9, additional verification of the HTTP Origin header has been added to the socket.io connection handler. By default, if the `Origin` header is present, it would be checked against the Host header. Connection would be denied if the hostnames do not match, which would indicate that the request is cross-origin. Connection would be allowed if the `Origin` header is not present. Users can override this behavior by setting environment variable `UPTIME_KUMA_WS_ORIGIN_CHECK=bypass`.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-1385, CWE-346
References: https://github.com/louislam/uptime-kuma/commit/2815cc73cfd9d8ced889e00e[PII_REDACTED]0d184f; https://github.com/louislam/uptime-kuma/security/advisories/GHSA-mj22-23ff-2hrr; https://github.com/louislam/uptime-kuma/commit/2815cc73cfd9d8ced889e00e[PII_REDACTED]0d184f
CVE: CVE-2023-50245
Published: 2023-12-11
Description: OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://github.com/afichet/openexr-viewer/commit/d0a7e85dfeb519951fb8a8d70f73f30d41cdd3d9; https://github.com/afichet/openexr-viewer/security/advisories/GHSA-99jg-r3f4-rpxj; https://github.com/afichet/openexr-viewer/commit/d0a7e85dfeb519951fb8a8d70f73f30d41cdd3d9
CVE: CVE-2023-36646
Published: 2023-12-12
Description: Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to execute privileged functions and achieve privilege escalation via REST API endpoint invocation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36646; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36646
CVE: CVE-2023-36647
Published: 2023-12-12
Description: A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate arbitrary users and roles in web management and REST API endpoints via crafted JWT tokens.
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36647; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36647
CVE: CVE-2023-36648
Published: 2023-12-12
Description: Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read potentially sensitive information and deny service to users by directly reading and writing data in Apache Kafka (as consumer and producer).
CVSS Score: 8.2 (HIGH)
CWE: CWE-287
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36648; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36648
CVE: CVE-2023-36649
Published: 2023-12-12
Description: Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs (as a Granafa authenticated user) or from the Loki REST API without authentication.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-532
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36649; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36649
CVE: CVE-2023-36650
Published: 2023-12-12
Description: A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux user on the host system via forged update packages.
CVSS Score: 7.2 (HIGH)
CWE: CWE-354
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36650; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36650
CVE: CVE-2023-36651
Published: 2023-12-12
Description: Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consume the most privileged REST API endpoints via these credentials.
CVSS Score: 7.2 (HIGH)
CWE: CWE-798
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36651; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36651
CVE: CVE-2023-36652
Published: 2023-12-12
Description: A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read database data via SQL commands injected in the search parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36652; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36652
CVE: CVE-2023-36654
Published: 2023-12-12
Description: Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download host server SSH private keys (associated with a Linux root user) by injecting paths inside REST API endpoint parameters.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36654; https://www.cvcn.gov.it/cvcn/cve/CVE-2023-36654
CVE: CVE-2023-40446
Published: 2023-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.1, iOS 16.7.2 and iPadOS 16.7.2, iOS 17.1 and iPadOS 17.1. Processing maliciously crafted input may lead to arbitrary code execution in user-installed apps.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/en-us/HT213981; https://support.apple.com/en-us/HT213982; https://support.apple.com/en-us/HT213983
CVE: CVE-2023-42476
Published: 2023-12-12
Description: SAP Business Objects Web Intelligence - version 420,  allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation can lead to exposure of the data that the user has access to. In the worst case, attacker could access data from reporting databases.


CVSS Score: 6.8 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3382353; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3382353
CVE: CVE-2023-42478
Published: 2023-12-12
Description: SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application.


CVSS Score: 7.5 (HIGH)
CWE: CWE-79
References: https://me.sap.com/notes/3382353; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3382353
CVE: CVE-2023-42479
Published: 2023-12-12
Description: An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.


CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://me.sap.com/notes/3383321; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3383321
CVE: CVE-2023-42481
Published: 2023-12-12
Description: In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Composable Storefront is used as storefront, due to weak access controls in place. This leads to a considerable impact on confidentiality and integrity.
CVSS Score: 8.1 (HIGH)
CWE: CWE-640
References: https://me.sap.com/notes/3394567; https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html; https://me.sap.com/notes/3394567
CVE: CVE-2023-42874
Published: 2023-12-12
Description: This issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.2. Secure text fields may be displayed via the Accessibility Keyboard when using a physical keyboard.
CVSS Score: 2.4 (LOW)
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42882
Published: 2023-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing an image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://packetstormsecurity.com/files/176536/macOS-AppleVADriver-Out-Of-Bounds-Write.html; http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036
CVE: CVE-2023-42883
Published: 2023-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. Processing an image may lead to a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/12; http://seclists.org/fulldisclosure/2023/Dec/13; http://seclists.org/fulldisclosure/2023/Dec/6
CVE: CVE-2023-42884
Published: 2023-12-12
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13.6.3, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. An app may be able to disclose kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/12; http://seclists.org/fulldisclosure/2023/Dec/7
CVE: CVE-2023-42886
Published: 2023-12-12
Description: An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. A user may be able to cause unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42890
Published: 2023-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in Safari 17.2, macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2023/Dec/12; http://seclists.org/fulldisclosure/2023/Dec/13; http://seclists.org/fulldisclosure/2023/Dec/6
CVE: CVE-2023-42891
Published: 2023-12-12
Description: An authentication issue was addressed with improved state management. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. An app may be able to monitor keystrokes without user permission.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42894
Published: 2023-12-12
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, macOS Ventura 13.6.3, macOS Monterey 12.7.2. An app may be able to access information about a user's contacts.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42897
Published: 2023-12-12
Description: The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker with physical access may be able to use Siri to access sensitive user data.
CVSS Score: 4.6 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/7; https://support.apple.com/en-us/HT214035; http://seclists.org/fulldisclosure/2023/Dec/7
CVE: CVE-2023-42898
Published: 2023-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, watchOS 10.2, iOS 17.2 and iPadOS 17.2, tvOS 17.2. Processing an image may lead to arbitrary code execution.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/12; http://seclists.org/fulldisclosure/2023/Dec/13; http://seclists.org/fulldisclosure/2023/Dec/7
CVE: CVE-2023-42899
Published: 2023-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Monterey 12.7.2. Processing an image may lead to arbitrary code execution.
CVSS Score: 7.8 (HIGH)
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/12
CVE: CVE-2023-42900
Published: 2023-12-12
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.2. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42901
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42902
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42903
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42904
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42905
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42906
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-119
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42907
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42908
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42909
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42910
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42911
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42912
Published: 2023-12-12
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Sonoma 14.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: http://seclists.org/fulldisclosure/2023/Dec/9; https://support.apple.com/en-us/HT214036; http://seclists.org/fulldisclosure/2023/Dec/9
CVE: CVE-2023-42914
Published: 2023-12-12
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3, tvOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Monterey 12.7.2. An app may be able to break out of its sandbox.
CVSS Score: 6.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/12
CVE: CVE-2023-42919
Published: 2023-12-12
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, watchOS 10.2, macOS Ventura 13.6.3, iOS 16.7.3 and iPadOS 16.7.3, macOS Monterey 12.7.2. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/13
CVE: CVE-2023-42922
Published: 2023-12-12
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iOS 17.2 and iPadOS 17.2, macOS Ventura 13.6.3, iOS 16.7.3 and iPadOS 16.7.3, macOS Monterey 12.7.2. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/10; http://seclists.org/fulldisclosure/2023/Dec/11; http://seclists.org/fulldisclosure/2023/Dec/7
CVE: CVE-2023-42923
Published: 2023-12-12
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.2 and iPadOS 17.2. Private Browsing tabs may be accessed without authentication.
CVSS Score: 5.3 (MEDIUM)
References: http://seclists.org/fulldisclosure/2023/Dec/7; https://support.apple.com/en-us/HT214035; http://seclists.org/fulldisclosure/2023/Dec/7