rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-40822 
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. An attacker with physical access to a device may be able to access contacts from the lock screen.
Problem types: description: An attacker with physical access to a device may be able to access contacts from the lock screen
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2024-07-29T22:16:58.864Z
CVE-2024-40823 
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:17:01.683Z
CVE-2024-40824 
This issue was addressed through improved state management. This issue is fixed in iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, tvOS 17.6, watchOS 10.6. An app may be able to bypass Privacy preferences.
Problem types: description: An app may be able to bypass Privacy preferences
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2024-07-29T22:17:09.635Z
CVE-2024-40825 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, visionOS 2. A malicious app with root privileges may be able to modify the contents of system files.
Problem types: description: A malicious app with root privileges may be able to modify the contents of system files
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2024-09-16T23:23:26.697Z
CVE-2024-40826 
A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An unencrypted document may be written to a temporary file when using print preview.
Problem types: description: An unencrypted document may be written to a temporary file when using print preview
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-09-16T23:22:12.703Z
CVE-2024-40827 
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to overwrite arbitrary files.
Problem types: description: An app may be able to overwrite arbitrary files
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:41.217Z
CVE-2024-40828 
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A malicious app may be able to gain root privileges.
Problem types: description: A malicious app may be able to gain root privileges
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:17:14.863Z
CVE-2024-40829 
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Ventura 13.6.8, watchOS 10.6. An attacker may be able to view restricted content from the lock screen.
Problem types: description: An attacker may be able to view restricted content from the lock screen
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2024-07-29T22:17:15.740Z
CVE-2024-40830 
This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to enumerate a user's installed apps.
Problem types: description: An app may be able to enumerate a user's installed apps
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-09-16T23:22:07.881Z
CVE-2024-40831 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library.
Problem types: description: An app may be able to access a user's Photos Library
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:30.195Z
CVE-2024-40832 
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. An app may be able to view a contact's phone number in system logs.
Problem types: description: An app may be able to view a contact's phone number in system logs
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:17:10.499Z
CVE-2024-40833 
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able to use sensitive data with certain actions without prompting the user.
Problem types: description: A shortcut may be able to use sensitive data with certain actions without prompting the user
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-07-29T22:17:20.886Z
CVE-2024-40834 
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able to bypass sensitive Shortcuts app settings.
Problem types: description: A shortcut may be able to bypass sensitive Shortcuts app settings
Affected products: vendor: Apple
product: macOS
Published: 2024-07-29T22:16:59.786Z
CVE-2024-40835 
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, watchOS 10.6. A shortcut may be able to use sensitive data with certain actions without prompting the user.
Problem types: description: A shortcut may be able to use sensitive data with certain actions without prompting the user
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2024-07-29T22:17:00.801Z
CVE-2024-40836 
A logic issue was addressed with improved checks. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. A shortcut may be able to use sensitive data with certain actions without prompting the user.
Problem types: description: A shortcut may be able to use sensitive data with certain actions without prompting the user
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: watchOS
Published: 2024-07-29T22:16:47.054Z
CVE-2024-40837 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data.
Problem types: description: An app may be able to access protected user data
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:44.799Z
CVE-2024-40838 
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in macOS Sequoia 15. A malicious app may be able to access notifications from the user's device.
Problem types: description: A malicious app may be able to access notifications from the user's device
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:55.333Z
CVE-2024-40839 
This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.
Problem types: description: An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2025-01-15T19:35:59.036Z
CVE-2024-40840 
This issue was addressed through improved state management. This issue is fixed in iOS 18 and iPadOS 18. An attacker with physical access may be able to use Siri to access sensitive user data.
Problem types: description: An attacker with physical access may be able to use Siri to access sensitive user data
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-09-16T23:22:46.728Z
CVE-2024-40841 
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted video file may lead to unexpected app termination.
Problem types: description: Processing a maliciously crafted video file may lead to unexpected app termination
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:32.912Z
CVE-2024-40842 
An issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:23:09.223Z
CVE-2024-40843 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:51.924Z
CVE-2024-40844 
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.7 and iPadOS 17.7, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to observe data displayed to the user by Shortcuts.
Problem types: description: An app may be able to observe data displayed to the user by Shortcuts
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2024-09-16T23:23:23.996Z
CVE-2024-40845 
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted video file may lead to unexpected app termination.
Problem types: description: Processing a maliciously crafted video file may lead to unexpected app termination
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:23:13.612Z
CVE-2024-40846 
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. Processing a maliciously crafted video file may lead to unexpected app termination.
Problem types: description: Processing a maliciously crafted video file may lead to unexpected app termination
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:18.135Z
CVE-2024-40847 
The issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to access sensitive user data.
Problem types: description: An app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:16.278Z
CVE-2024-40848 
A downgrade issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An attacker may be able to read sensitive information.
Problem types: description: An attacker may be able to read sensitive information
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:23:29.232Z
CVE-2024-40849 
A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.1. An app may be able to break out of its sandbox.
Problem types: description: An app may be able to break out of its sandbox
Affected products: vendor: Apple
product: macOS
Published: 2026-04-02T18:22:35.062Z
CVE-2024-40850 
A file access issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7, tvOS 18, visionOS 2, watchOS 11. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-09-16T23:22:21.900Z
CVE-2024-40851 
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker with physical access may be able to access contact photos from the lock screen.
Problem types: description: An attacker with physical access may be able to access contact photos from the lock screen
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-10-28T21:07:45.498Z
CVE-2024-40852 
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to see recent photos without authentication in Assistive Access.
Problem types: description: An attacker may be able to see recent photos without authentication in Assistive Access
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-09-16T23:23:22.334Z
CVE-2024-40853 
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to use Siri to enable Auto-Answer Calls.
Problem types: description: An attacker may be able to use Siri to enable Auto-Answer Calls
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-10-28T21:08:32.602Z
CVE-2024-40854 
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to cause unexpected system termination.
Problem types: description: An app may be able to cause unexpected system termination
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
Published: 2025-01-15T19:35:59.681Z
CVE-2024-40855 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1, macOS Ventura 13.7.1, visionOS 2. A sandboxed app may be able to access sensitive user data.
Problem types: description: A sandboxed app may be able to access sensitive user data
Affected products: vendor: Apple
product: macOS
vendor: Apple
product: visionOS
Published: 2024-10-28T21:08:13.758Z
CVE-2024-40856 
An integrity issue was addressed with Beacon Protection. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18. An attacker may be able to force a device to disconnect from a secure network.
Problem types: description: An attacker may be able to force a device to disconnect from a secure network
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
Published: 2024-09-16T23:22:50.203Z
CVE-2024-40857 
This issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, macOS Sequoia 15, tvOS 18, visionOS 2, watchOS 11. Processing maliciously crafted web content may lead to universal cross site scripting.
Problem types: description: Processing maliciously crafted web content may lead to universal cross site scripting
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: visionOS
vendor: Apple
product: watchOS
Published: 2024-09-16T23:22:32.092Z
CVE-2024-40858 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. An app may be able to access Contacts without user consent.
Problem types: description: An app may be able to access Contacts without user consent
Affected products: vendor: Apple
product: macOS
Published: 2026-04-02T18:20:41.441Z
CVE-2024-40859 
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access user-sensitive data.
Problem types: description: An app may be able to access user-sensitive data
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:23:01.051Z
CVE-2024-40860 
A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to modify protected parts of the file system.
Problem types: description: An app may be able to modify protected parts of the file system
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:41.618Z
CVE-2024-40861 
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to gain root privileges.
Problem types: description: An app may be able to gain root privileges
Affected products: vendor: Apple
product: macOS
Published: 2024-09-16T23:22:35.793Z
CVE-2024-40862 
A privacy issue was addressed by removing sensitive data. This issue is fixed in Xcode 16. An attacker may be able to determine the Apple ID of the owner of the computer.
Problem types: description: An attacker may be able to determine the Apple ID of the owner of the computer
Affected products: vendor: Apple
product: Xcode
Published: 2024-09-16T23:23:05.016Z
CVE-2024-40863 
This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to leak sensitive user information.
Problem types: description: An app may be able to leak sensitive user information
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-09-16T23:23:04.055Z
CVE-2024-40864 
The issue was addressed with improved handling of protocols. This issue is fixed in iOS 18.2 and iPadOS 18.2, macOS Sequoia 15.2, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.2, watchOS 11.2. An attacker in a privileged network position may be able to track a user's activity.
Problem types: description: An attacker in a privileged network position may be able to track a user's activity
Affected products: vendor: Apple
product: iOS and iPadOS
vendor: Apple
product: macOS
vendor: Apple
product: tvOS
vendor: Apple
product: watchOS
Published: 2025-03-31T22:24:22.413Z
CVE-2024-40865 
The issue was addressed by suspending Persona when the virtual keyboard is active. This issue is fixed in visionOS 1.3. Inputs to the virtual keyboard may be inferred from Persona.
Problem types: description: Inputs to the virtual keyboard may be inferred from Persona
Affected products: vendor: Apple
product: visionOS
Published: 2024-09-06T01:23:53.981Z
CVE-2024-40866 
The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious website may lead to address bar spoofing.
Problem types: description: Visiting a malicious website may lead to address bar spoofing
Affected products: vendor: Apple
product: Safari
vendor: Apple
product: macOS
Published: 2024-09-16T23:22:28.243Z
CVE-2024-40867 
A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in iOS 18.1 and iPadOS 18.1. A remote attacker may be able to break out of Web Content sandbox.
Problem types: description: A remote attacker may be able to break out of Web Content sandbox
Affected products: vendor: Apple
product: iOS and iPadOS
Published: 2024-10-28T21:07:40.434Z
CVE-2024-40872 Elevation of privilege in Absolute Secure Access clients and servers
There is an elevation of privilege vulnerability in server
and client components of Absolute Secure Access prior to version 13.07.
Attackers with local access and valid desktop user credentials can elevate
their privilege to system level by passing invalid address data to the vulnerable
component. This could be used to
manipulate process tokens to elevate the privilege of a normal process to
System. The scope is changed, the impact to system confidentiality and
integrity is high, the impact to the availability of the effected component is
none.
Problem types: cwe_id: CWE-822
description: CWE-822 Untrusted Pointer Dereference
Affected products: vendor: Absolute Security
product: Secure Access
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
version: 3.1
Published: 2024-07-25T17:00:38.151Z
CVE-2024-40873 XSS in Secure Access administrative console
There is a cross-site scripting vulnerability in the Secure
Access administrative console of Absolute Secure Access prior to version 13.07.
Attackers with system administrator permissions can interfere with another
system administrator’s use of the publishing UI when the administrators are
editing the same management object. The scope is unchanged, there is no loss of
confidentiality. Impact to system availability is none, impact to system
integrity is high.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Absolute Security
product: Secure Access
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2024-07-25T17:19:28.906Z
CVE-2024-40875 Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52
There is a cross-site scripting vulnerability in the
management console of Absolute Secure Access prior to version 13.52. Attackers
with system administrator permissions can interfere with another system
administrator’s use of the management console when the second administrator logs
in. Attack complexity is high, attack requirements are present, privileges
required are high, user interaction required is none. The impact to
confidentiality is none, the impact to availability is low, and the impact to
system integrity is high.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: Absolute Software
product: Secure Access
default_status: unaffected
Published: 2024-12-20T20:17:27.132Z
CVE-2024-40883 
Cross-site request forgery vulnerability exists in ELECOM wireless LAN routers. Viewing a malicious page while logging in to the affected product with an administrative privilege, the user may be directed to perform unintended operations such as changing the login ID, login password, etc.
Problem types: cwe_id: CWE-352
description: Cross-site request forgery (CSRF)
Affected products: vendor: ELECOM CO.,LTD.
product: WRC-X1500GS-B
vendor: ELECOM CO.,LTD.
product: WRC-X1500GSA-B
vendor: ELECOM CO.,LTD.
product: WRC-X1800GS-B
vendor: ELECOM CO.,LTD.
product: WRC-X1800GSA-B
vendor: ELECOM CO.,LTD.
product: WRC-X1800GSH-B
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2-B
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2-W
vendor: ELECOM CO.,LTD.
product: WRC-X3000GS2A-B
vendor: ELECOM CO.,LTD.
product: WRC-XE5400GS-G
vendor: ELECOM CO.,LTD.
product: WRC-XE5400GSA-G
vendor: ELECOM CO.,LTD.
product: WRC-X6000QS-G
vendor: ELECOM CO.,LTD.
product: WRC-X6000QSA-G
vendor: ELECOM CO.,LTD.
product: WRC-X6000XS-G
vendor: ELECOM CO.,LTD.
product: WRC-X6000XST-G
vendor: ELECOM CO.,LTD.
product: WRC-X3000GST2-B
Published: 2024-08-01T01:18:01.801Z