deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-30788
Published: 2022-05-26
Description: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x; https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
CVE: CVE-2022-30789
Published: 2022-05-26
Description: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-20
References: https://github.com/tuxera/ntfs-3g/releases; https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-xchm-ph5h-hw4x; https://lists.debian.org/debian-lts-announce/2022/06/msg00017.html
CVE: CVE-2021-33014
Published: 2022-05-26
Description: An attacker can gain VxWorks Shell after login due to hard-coded credentials on a KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
CVSS Score: 8.8 (HIGH)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-01
CVE: CVE-2021-33016
Published: 2022-05-26
Description: An attacker can gain full access (read/write/delete) to sensitive folders due to hard-coded credentials on KUKA KR C4 control software for versions prior to 8.7 or any product running KSS.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-01; https://www.cisa.gov/uscert/ics/advisories/icsa-21-208-01
CVE: CVE-2021-4232
Published: 2022-05-26
Description: A vulnerability classified as problematic has been found in Zoo Management System 1.0. Affected is an unknown function of the file admin/manage-ticket.php. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. It is possible to launch the attack remotely.
CVSS Score: 3.5 (LOW)
CWE: CWE-79, CWE-79
References: https://vuldb.com/?id.178254; https://vuldb.com/?id.178254
CVE: CVE-2022-1261
Published: 2022-05-26
Description: Matrikon, a subsidary of Honeywell Matrikon OPC Server (all versions) is vulnerable to a condition where a low privileged user allowed to connect to the OPC server to use the functions of the IPersisFile to execute operating system processes with system-level privileges.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-284
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-02
CVE: CVE-2022-1882
Published: 2022-05-26
Description: A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is already called. This flaw allows a local user to crash or potentially escalate their privileges on the system.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2089701; https://lore.kernel.org/lkml/[PII_REDACTED]5605.96775-1-tcs.kernel%40gmail.com/T/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-1899
Published: 2022-05-26
Description: Out-of-bounds Read in GitHub repository radareorg/radare2 prior to 5.7.0.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-125
References: https://github.com/radareorg/radare2/commit/193f4fe01d7f626e2ea937450f2e0c4604420e9d; https://huntr.dev/bounties/8a3dc5cb-08b3-4807-82b2-77f08c137a04; https://github.com/radareorg/radare2/commit/193f4fe01d7f626e2ea937450f2e0c4604420e9d
CVE: CVE-2022-21827
Published: 2022-05-26
Description: An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM.
CVSS Score: 7.1 (HIGH)
CWE: CWE-269, CWE-269
References: https://support.citrix.com/article/CTX341455; https://support.citrix.com/article/CTX341455
CVE: CVE-2022-21831
Published: 2022-05-26
Description: A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: https://github.com/advisories/GHSA-w749-p3v6-hccq; https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-22576
Published: 2022-05-26
Description: An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only).
CVSS Score: 8.1 (HIGH)
CWE: CWE-287, CWE-306
References: https://hackerone.com/reports/1526328; https://lists.debian.org/debian-lts-announce/2022/08/msg00017.html; https://security.gentoo.org/glsa/202212-01
CVE: CVE-2022-22577
Published: 2022-05-26
Description: An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533; https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2022-27777
Published: 2022-05-26
Description: A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.rubyonrails.org/t/cve-2022-27777-possible-xss-vulnerability-in-action-view-tag-helpers/80534; https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html; https://www.debian.org/security/2023/dsa-5372
CVE: CVE-2022-30493
Published: 2022-05-26
Description: In oretnom23 Automotive Shop Management System v1.0, the product id parameter suffers from a blind SQL Injection Vulnerability allowing remote attackers to dump all database credential and gain admin access(privilege escalation).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/nsparker1337/OpenSource/blob/main/exploit_sql_asms.md; https://github.com/nsparker1337/OpenSource/blob/main/exploit_sql_asms.md
CVE: CVE-2022-30494
Published: 2022-05-26
Description: In oretnom23 Automotive Shop Management System v1.0, the first and last name user fields suffer from a stored XSS Injection Vulnerability allowing remote attackers to gain admin access and view internal IPs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/nsparker1337/OpenSource/blob/main/exploit_xss_asms.md; https://github.com/nsparker1337/OpenSource/blob/main/exploit_xss_asms.md
CVE: CVE-2022-30495
Published: 2022-05-26
Description: In oretnom23 Automotive Shop Management System v1.0, the name id parameter is vulnerable to IDOR - Broken Access Control allowing attackers to change the admin password(vertical privilege escalation)
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-639
References: https://github.com/nsparker1337/OpenSource/blob/main/exploit_idor_asms.md; https://github.com/nsparker1337/OpenSource/blob/main/exploit_idor_asms.md
CVE: CVE-2022-30516
Published: 2022-05-26
Description: In Hospital-Management-System v1.0, the editid parameter in the doctor.php page is vulnerable to SQL injection attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/Danie1233/Hospital-Management-System-V1.0-SQLi/; https://github.com/Danie1233/Hospital-Management-System-V1.0-SQLi/
CVE: CVE-2022-22616
Published: 2022-05-26
Description: This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213184; https://support.apple.com/en-us/HT213185
CVE: CVE-2022-22662
Published: 2022-05-26
Description: A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information.
CVSS Score: 6.5 (MEDIUM)
References: http://www.openwall.com/lists/oss-security/2022/07/05/3; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/33BWWAQLLBHKGSI332ZZCORTFZ2XLOIH/; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANNHXXARVBRGI74TVQNZOAG6P7AGSMUJ/
CVE: CVE-2022-22663
Published: 2022-05-26
Description: This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-004 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.6. A malicious application may bypass Gatekeeper checks.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213182; https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213255
CVE: CVE-2022-22672
Published: 2022-05-26
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213182; https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213184
CVE: CVE-2022-22673
Published: 2022-05-26
Description: This issue was addressed with improved checks. This issue is fixed in iOS 15.5 and iPadOS 15.5. Processing a large input may lead to a denial of service.
CVSS Score: 7.5 (HIGH)
References: https://support.apple.com/en-us/HT213258; https://support.apple.com/en-us/HT213258
CVE: CVE-2022-22674
Published: 2022-05-26
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://support.apple.com/en-us/HT213220; https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-22675
Published: 2022-05-26
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.3.1, iOS 15.4.1 and iPadOS 15.4.1. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited..
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/en-us/HT213219; https://support.apple.com/en-us/HT213220; https://support.apple.com/en-us/HT213253
CVE: CVE-2022-22676
Published: 2022-05-26
Description: An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213054; https://support.apple.com/en-us/HT213054
CVE: CVE-2022-26688
Published: 2022-05-26
Description: An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious app with root privileges may be able to modify the contents of system files.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213184; https://support.apple.com/en-us/HT213185
CVE: CVE-2022-26690
Published: 2022-05-26
Description: Description: A race condition was addressed with additional validation. This issue is fixed in macOS Monterey 12.3. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://support.apple.com/en-us/HT213183; https://support.apple.com/en-us/HT213183
CVE: CVE-2022-26691
Published: 2022-05-26
Description: A logic issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to gain elevated privileges.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-697
References: https://github.com/OpenPrinting/cups/commit/de4f8c196106033e4c372dce3e91b9d42b0b9444; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0026/MNDT-2022-0026.md; https://lists.debian.org/debian-lts-announce/2022/05/msg00039.html
CVE: CVE-2022-30508
Published: 2022-05-26
Description: DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/1security/Vulnerability/blob/master/web/dedecms/1.md; https://github.com/1security/Vulnerability/blob/master/web/dedecms/1.md
CVE: CVE-2022-31265
Published: 2022-05-26
Description: The replay feature in the client in Wargaming World of Warships 0.11.4 allows remote attackers to execute code when a user launches a replay from an untrusted source.
CVSS Score: 8.8 (HIGH)
CWE: CWE-294
References: https://imgur.com/a/cm5E0jb; https://imgur.com/a/cm5E0jb
CVE: CVE-2022-26693
Published: 2022-05-26
Description: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. A plug-in may be able to inherit the application's permissions and access user data.
CVSS Score: 9.1 (CRITICAL)
References: https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26694
Published: 2022-05-26
Description: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. A plug-in may be able to inherit the application's permissions and access user data.
CVSS Score: 9.1 (CRITICAL)
References: https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26697
Published: 2022-05-26
Description: An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26698
Published: 2022-05-26
Description: An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. Processing a maliciously crafted AppleScript binary may result in unexpected application termination or disclosure of process memory.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26701
Published: 2022-05-26
Description: A race condition was addressed with improved locking. This issue is fixed in tvOS 15.5, macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213258
CVE: CVE-2022-26702
Published: 2022-05-26
Description: A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 8.6, tvOS 15.5, iOS 15.5 and iPadOS 15.5. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://seclists.org/fulldisclosure/2023/Mar/21; https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254
CVE: CVE-2022-26703
Published: 2022-05-26
Description: An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.5 and iPadOS 15.5. A person with physical access to an iOS device may be able to access photos from the lock screen.
CVSS Score: 2.4 (LOW)
References: https://support.apple.com/en-us/HT213258; https://support.apple.com/en-us/HT213258
CVE: CVE-2022-26704
Published: 2022-05-26
Description: A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-59
References: http://seclists.org/fulldisclosure/2022/Jul/13; http://seclists.org/fulldisclosure/2022/Jul/14; https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0032/MNDT-2022-0032.md
CVE: CVE-2022-26706
Published: 2022-05-26
Description: An access issue was addressed with additional sandbox restrictions on third-party applications. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-26708
Published: 2022-05-26
Description: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An attacker may be able to cause unexpected application termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
References: https://support.apple.com/en-us/HT213257; https://support.apple.com/kb/HT213253; https://support.apple.com/kb/HT213254
CVE: CVE-2022-26711
Published: 2022-05-26
Description: An integer overflow issue was addressed with improved input validation. This issue is fixed in tvOS 15.5, iTunes 12.12.4 for Windows, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Monterey 12.4. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26712
Published: 2022-05-26
Description: This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-26714
Published: 2022-05-26
Description: A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213255
CVE: CVE-2022-26715
Published: 2022-05-26
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. An application may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26718
Published: 2022-05-26
Description: An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An application may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-26720
Published: 2022-05-26
Description: An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26721
Published: 2022-05-26
Description: A memory initialization issue was addressed. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26722
Published: 2022-05-26
Description: A memory initialization issue was addressed. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to gain root privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-665
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26723
Published: 2022-05-26
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://support.apple.com/en-us/HT213256; https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-26724
Published: 2022-05-26
Description: An authentication issue was addressed with improved state management. This issue is fixed in tvOS 15.5. A local user may be able to enable iCloud Photos without authentication.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-287
References: https://support.apple.com/en-us/HT213254; https://support.apple.com/en-us/HT213254
CVE: CVE-2022-26725
Published: 2022-05-26
Description: A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4. Photo location information may persist after it is removed with Preview Inspector.
CVSS Score: 5.3 (MEDIUM)
References: https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213257
CVE: CVE-2022-26726
Published: 2022-05-26
Description: This issue was addressed with improved checks. This issue is fixed in Security Update 2022-004 Catalina, watchOS 8.6, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to capture a user's screen.
CVSS Score: 6.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213253; https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213256
CVE: CVE-2022-26727
Published: 2022-05-26
Description: This issue was addressed with improved entitlements. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4. A malicious application may be able to modify protected parts of the file system.
CVSS Score: 5.5 (MEDIUM)
References: https://support.apple.com/en-us/HT213255; https://support.apple.com/en-us/HT213257; https://support.apple.com/en-us/HT213255