deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-45413
Published: 2024-09-16
Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. This function is an API wrapper for LUA to decrypt RSA encrypted ciphertext, the decrypted data is stored on the stack without checking its length. An authenticated attacker can get RCE as root by exploiting this vulnerability.
CVSS Score: 8.1 (HIGH)
CWE: CWE-121
References: https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE: CVE-2024-45414
Published: 2024-09-16
Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. This function is responsible for decrypting RSA encrypted ciphertext, the encrypted data is supplied base64 encoded. The decoded ciphertext is stored on the stack without checking its length. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE: CVE-2024-45415
Published: 2024-09-16
Description: The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. This function is responsible for validating the checksum of data in post request. The checksum is sent encrypted in the request, the function decrypts it and stores the checksum on the stack without validating it. An unauthenticated attacker can get RCE as root by exploiting this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-121
References: https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE: CVE-2024-45416
Published: 2024-09-16
Description: The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. The session -LUA- files are stored in the directory /var/lua_session, the function iterates on all files in this directory and executes them using the function dofile without any validation if it is a valid session file or not. An attacker who is able to write a malicious file in the sessions directory can get RCE as root.
CVSS Score: 8.1 (HIGH)
CWE: CWE-829
References: https://wr3nchsr.github.io/zte-multiple-routers-httpd-vulnerabilities-advisory/
CVE: CVE-2024-4283
Published: 2024-09-16
Description: An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-601, CWE-601
References: https://gitlab.com/gitlab-org/gitlab/-/issues/458502; https://hackerone.com/reports/2474286
CVE: CVE-2024-6685
Published: 2024-09-16
Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2,  where group runners information was disclosed to unauthorised group members.
CVSS Score: 3.1 (LOW)
CWE: CWE-639
References: https://gitlab.com/gitlab-org/gitlab/-/issues/472012; https://hackerone.com/reports/2584372
CVE: CVE-2024-23237
Published: 2024-09-17
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to cause a denial-of-service.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-27795
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-281
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-27858
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-27860
Published: 2024-09-17
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-27861
Published: 2024-09-17
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An application may be able to read restricted memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-27869
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to record the screen without an indicator.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-27874
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A remote attacker may be able to cause a denial-of-service.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-27875
Published: 2024-09-17
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15. Privacy Indicators for microphone or camera access may be attributed incorrectly.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-27876
Published: 2024-09-17
Description: A race condition was addressed with improved locking. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, visionOS 2. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362, CWE-362
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246
CVE: CVE-2024-27879
Published: 2024-09-17
Description: The issue was addressed with improved bounds checks. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18. An attacker may be able to cause unexpected app termination.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-119
References: https://support.apple.com/en-us/121246; https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-27880
Published: 2024-09-17
Description: An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, tvOS 18, visionOS 2, watchOS 11. Processing a maliciously crafted file may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121246
CVE: CVE-2024-40770
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A non-privileged user may be able to modify restricted network settings.
CVSS Score: 7.5 (HIGH)
CWE: CWE-281, CWE-863
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40790
Published: 2024-09-17
Description: The issue was addressed with improved handling of caches. This issue is fixed in visionOS 2. An app may be able to read sensitive data from the GPU memory.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121249; http://seclists.org/fulldisclosure/2024/Sep/36
CVE: CVE-2024-40791
Published: 2024-09-17
Description: A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access information about a user's contacts.
CVSS Score: 3.3 (LOW)
CWE: CWE-532, CWE-532
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246
CVE: CVE-2024-40797
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. Visiting a malicious website may lead to user interface spoofing.
CVSS Score: 6.1 (MEDIUM)
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-40801
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40825
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, visionOS 2. A malicious app with root privileges may be able to modify the contents of system files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-284
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121249; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40826
Published: 2024-09-17
Description: A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An unencrypted document may be written to a temporary file when using print preview.
CVSS Score: 6.1 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-40830
Published: 2024-09-17
Description: This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to enumerate a user's installed apps.
CVSS Score: 3.3 (LOW)
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-40831
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40837
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40838
Published: 2024-09-17
Description: A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15. A malicious app may be able to access notifications from the user's device.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40840
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to use Siri to access sensitive user data.
CVSS Score: 4.6 (MEDIUM)
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-40841
Published: 2024-09-17
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted video file may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787, CWE-400
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40842
Published: 2024-09-17
Description: An issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40843
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40844
Published: 2024-09-17
Description: A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to observe data displayed to the user by Shortcuts.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121246
CVE: CVE-2024-40845
Published: 2024-09-17
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted video file may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40846
Published: 2024-09-17
Description: The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted video file may lead to unexpected app termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40847
Published: 2024-09-17
Description: The issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-40848
Published: 2024-09-17
Description: A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An attacker may be able to read sensitive information.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-40850
Published: 2024-09-17
Description: A file access issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, tvOS 18, visionOS 2, watchOS 11. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240
CVE: CVE-2024-40852
Published: 2024-09-17
Description: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to see recent photos without authentication in Assistive Access.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-40856
Published: 2024-09-17
Description: An integrity issue was addressed with Beacon Protection. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18. An attacker may be able to force a device to disconnect from a secure network.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121248; https://support.apple.com/en-us/121250
CVE: CVE-2024-40857
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing maliciously crafted web content may lead to universal cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121240; https://support.apple.com/en-us/121241
CVE: CVE-2024-40859
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-281, CWE-281
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40860
Published: 2024-09-17
Description: A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40861
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-40862
Published: 2024-09-17
Description: A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121239; http://seclists.org/fulldisclosure/2024/Sep/38
CVE: CVE-2024-40863
Published: 2024-09-17
Description: This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-40866
Published: 2024-09-17
Description: The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121241; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44124
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. A malicious Bluetooth input device may bypass pairing.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-44125
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. A malicious application may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44127
Published: 2024-09-17
Description: This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18. Private Browsing tabs may be accessed without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/121246; https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-44128
Published: 2024-09-17
Description: This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An Automator Quick Action workflow may be able to bypass Gatekeeper.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-841
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247
CVE: CVE-2024-44129
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Ventura 13.7. An app may be able to leak sensitive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: https://support.apple.com/en-us/121234; https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44130
Published: 2024-09-17
Description: This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15. An app with root privileges may be able to access private information.
CVSS Score: 4.4 (MEDIUM)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44131
Published: 2024-09-17
Description: This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sensitive user data.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59, CWE-59
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-44132
Published: 2024-09-17
Description: This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59, CWE-61
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44133
Published: 2024-09-17
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15. On MDM managed devices, an app may be able to bypass certain Privacy preferences.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44134
Published: 2024-09-17
Description: This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15. An app may be able to read sensitive location information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44135
Published: 2024-09-17
Description: A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access protected files within an App Sandbox container.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-276
References: https://support.apple.com/en-us/121238; https://support.apple.com/en-us/121247; http://seclists.org/fulldisclosure/2024/Sep/33
CVE: CVE-2024-44139
Published: 2024-09-17
Description: The issue was addressed with improved checks. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to access contacts from the lock screen.
CVSS Score: 2.4 (LOW)
CWE: CWE-200
References: https://support.apple.com/en-us/121250; http://seclists.org/fulldisclosure/2024/Sep/32
CVE: CVE-2024-44146
Published: 2024-09-17
Description: A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.
CVSS Score: 10.0 (CRITICAL)
References: https://support.apple.com/en-us/121238; http://seclists.org/fulldisclosure/2024/Sep/33