rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-27770 Unitronics Unistream Unilogic – Versions prior to 1.35.227  CWE-23: Relative Path Traversal

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - 

CWE-23: Relative Path Traversal


Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Unitronics 
product: Unistream Unilogic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe, Vera Mens of Claroty Team82
Published: 2024-03-18T13:23:31.838Z
CVE-2024-27771 Unitronics Unistream Unilogic – Versions prior to 1.35.227  CWE-22: 'Path Traversal'

Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-22: 'Path Traversal' may allow RCE


Problem types: cwe_id: CWE-22
description: CWE-22: 'Path Traversal'
Affected products: vendor: Unitronics 
product: Unistream Unilogic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe, Vera Mens of Claroty Team82
Published: 2024-03-18T13:27:39.449Z
CVE-2024-27772 Unitronics Unistream Unilogic – Versions prior to 1.35.227  CWE-78: 'OS Command Injection'

Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-78: 'OS Command Injection' may allow RCE


Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Unitronics 
product: Unistream Unilogic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe, Vera Mens of Claroty Team82
Published: 2024-03-18T13:28:35.731Z
CVE-2024-27773 Unitronics Unistream Unilogic – Versions prior to 1.35.227  CWE-348: Use of Less Trusted Source

Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-348: Use of Less Trusted Source may allow RCE


Problem types: cwe_id: CWE-348
description: CWE-348: Use of Less Trusted Source
Affected products: vendor: Unitronics 
product: Unistream Unilogic
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe, Vera Mens of Claroty Team82
Published: 2024-03-18T13:32:46.698Z
CVE-2024-27774 Unitronics Unistream Unilogic – Versions prior to 1.35.227  CWE-259: Use of Hard-coded Password

Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware


Problem types: cwe_id: CWE-259
description: CWE-259: Use of Hard-coded Password
Affected products: vendor: Unitronics 
product: Unistream Unilogic
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Noam Moshe, Vera Mens of Claroty Team82
Published: 2024-03-18T13:34:31.538Z
CVE-2024-27775 SysAid - CWE-918: Server-Side Request Forgery (SSRF)

SysAid before version 23.2.14 b18 - CWE-918: Server-Side Request Forgery (SSRF) may allow exposing the local OS user's NTLMv2 hash


Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: SysAid
product: SysAid
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Niv Levy
Published: 2024-03-28T12:19:53.385Z
CVE-2024-27776 MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
MileSight DeviceHub - 

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: MileSight
product: DeviceHub
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Claroty Research – Team 82
Published: 2024-06-02T13:13:03.786Z
CVE-2024-27778 
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0.5 through 3.0.7 allows an authenticated attacker with at least read-only permission to execute unauthorized commands via crafted requests.
Problem types: cwe_id: CWE-78
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSandbox
cpes: cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.5:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X
Published: 2025-01-14T14:09:34.439Z
CVE-2024-27780 
Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM  7.1 all versions, 7.0 all versions, 6.7 all versions incident page may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests.
Problem types: cwe_id: CWE-79
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSIEM
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 2.2
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:F/RL:X/RC:X
Published: 2025-02-11T16:09:12.668Z
CVE-2024-27781 
An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions, FortiSandbox 3.1 all versions, FortiSandbox 3.0 all versions allows an authenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
Problem types: cwe_id: CWE-79
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiSandbox
cpes: cpe:2.3:a:fortinet:fortisandbox:4.4.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.4.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:4.0.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.2.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.1.0:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.7:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.6:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.5:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.4:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.3:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.1:*:*:*:*:*:*:*
cpe:2.3:a:fortinet:fortisandbox:3.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X
Published: 2025-02-11T16:09:12.324Z
CVE-2024-27782 
Multiple insufficient session expiration weaknesses [CWE-613] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an attacker to re-use stolen old session tokens to perform unauthorized operations via crafted requests.
Problem types: cwe_id: CWE-613
description: Improper access control
Affected products: vendor: Fortinet
product: FortiAIOps
cpes: cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Published: 2024-07-09T15:33:30.678Z
CVE-2024-27783 
Multiple cross-site request forgery (CSRF) weaknesses [CWE-352] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an unauthenticated remote attacker to perform arbitrary actions on behalf of an authenticated user via tricking the victim to execute malicious GET requests.
Problem types: cwe_id: CWE-352
description: Improper access control
Affected products: vendor: Fortinet
product: FortiAIOps
cpes: cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L/E:P/RL:U/RC:C
Published: 2024-07-09T15:33:27.135Z
CVE-2024-27784 
Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated, remote attacker to retrieve sensitive information from the API endpoint or log files.
Problem types: cwe_id: CWE-532
description: Information disclosure
Affected products: vendor: Fortinet
product: FortiAIOps
cpes: cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Published: 2024-07-09T15:33:27.590Z
CVE-2024-27785 
An improper neutralization of formula elements in a CSV File [CWE-1236] vulnerability in Fortinet FortiAIOps 2.0.0 may allow a remote authenticated attacker to execute arbitrary commands on a client's workstation via poisoned CSV reports.
Problem types: cwe_id: CWE-1236
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiAIOps
cpes: cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L/E:P/RL:U/RC:C
Published: 2024-07-09T15:33:27.182Z
CVE-2024-27789 
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Sonoma 14.4, macOS Ventura 13.6.7. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-05-13T23:00:51.598Z
CVE-2024-27790 
Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue has been fixed in FileMaker Server 20.3.2 by validating transactions before replying to client requests.
Problem types: description: Claris International has resolved an issue of potentially allowing unauthorized access to records stored in databases hosted on FileMaker Server. This issue has been fixed in FileMaker Server 20.3.2 by validating transactions before replying to client requests.
Affected products: vendor: Claris
product: FileMaker Server
Published: 2024-04-26T15:33:46.330Z
CVE-2024-27791 
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, tvOS 17.3. An app may be able to corrupt coprocessor memory.
Problem types: description: An app may be able to corrupt coprocessor memory
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
Published: 2024-04-24T16:43:44.979Z
CVE-2024-27792 
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2024-06-10T19:20:58.327Z
CVE-2024-27793 
The issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected app termination or arbitrary code execution.
Problem types: description: Parsing a file may lead to an unexpected app termination or arbitrary code execution
Affected products: vendor: Apple
product: iTunes for Windows
Published: 2024-05-08T22:15:21.788Z
CVE-2024-27794 
Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint. The vulnerability was resolved in FileMaker Server 20.3.2 by escaping the HTML contents of the login error message on the login page.
Problem types: description: Claris FileMaker Server before version 20.3.2 was susceptible to a reflected Cross-Site Scripting vulnerability due to an improperly handled parameter in the FileMaker WebDirect login endpoint.
Affected products: vendor: Claris
product: FileMaker Server
Published: 2024-04-15T22:16:30.367Z
CVE-2024-27795 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A camera extension may be able to access the internet.
Problem types: description: A camera extension may be able to access the internet
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:23.747Z
CVE-2024-27796 
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An attacker may be able to elevate privileges.
Problem types: description: An attacker may be able to elevate privileges
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-05-13T23:00:54.914Z
CVE-2024-27798 
An authorization issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An attacker may be able to elevate privileges.
Problem types: description: An attacker may be able to elevate privileges
Affected products: vendor: Apple
product: macOS
Published: 2024-05-13T23:00:46.368Z
CVE-2024-27799 
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7. An unprivileged app may be able to log keystrokes in other apps including those using secure input mode.
Problem types: description: An unprivileged app may be able to log keystrokes in other apps including those using secure input mode
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-06-10T20:56:39.019Z
CVE-2024-27800 
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a maliciously crafted message may lead to a denial-of-service.
Problem types: description: Processing a maliciously crafted message may lead to a denial-of-service
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-06-10T20:56:44.028Z
CVE-2024-27801 
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to elevate privileges.
Problem types: description: An app may be able to elevate privileges
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-06-10T20:56:42.157Z
CVE-2024-27802 
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.
Problem types: description: Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
Published: 2024-06-10T20:56:41.329Z
CVE-2024-27803 
A permissions issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access may be able to share items from the lock screen.
Problem types: description: An attacker with physical access may be able to share items from the lock screen
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-05-13T23:00:49.678Z
CVE-2024-27804 
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, watchOS 10.5. An app may be able to cause unexpected system termination.
Problem types: description: An app may be able to cause unexpected system termination
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-05-13T23:00:48.211Z
CVE-2024-27805 
An issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2024-06-10T20:56:36.274Z
CVE-2024-27806 
This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, watchOS 10.5. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2024-06-10T20:56:47.031Z
CVE-2024-27807 
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5. An app may be able to circumvent App Privacy Report logging.
Problem types: description: An app may be able to circumvent App Privacy Report logging
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-06-10T20:56:46.171Z