Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2024-AVI-0929
Vulnerability from certfr_avis - Published: 2024-10-29 - Updated: 2024-10-29
De multiples vulnérabilités ont été découvertes dans les produits Apple. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apple | N/A | tvOS 18.1 versions antérieures à 18.1 | ||
| Apple | iOS | iOS et iPadOS versions antérieures à 18.1 | ||
| Apple | iOS | iOS et iPadOS versions antérieures à 17.7.1 | ||
| Apple | macOS | macOS Sequoia versions antérieures à 15.1 | ||
| Apple | macOS | macOS Sonoma versions antérieures à 14.7.1 | ||
| Apple | N/A | watchOS 11.1 versions antérieures à 11.1 | ||
| Apple | macOS | macOS Ventura versions antérieures à 13.7.1 | ||
| Apple | N/A | visionOS 2.1 versions antérieures à 2.1 |
References
| Title | Publication Time | Tags | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "tvOS\u00a018.1 versions ant\u00e9rieures \u00e0 18.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS et iPadOS versions ant\u00e9rieures \u00e0 18.1",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "iOS et iPadOS versions ant\u00e9rieures \u00e0 17.7.1",
"product": {
"name": "iOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sequoia versions ant\u00e9rieures \u00e0 15.1",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Sonoma versions ant\u00e9rieures \u00e0 14.7.1",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "watchOS\u00a011.1 versions ant\u00e9rieures \u00e0 11.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "macOS Ventura versions ant\u00e9rieures \u00e0 13.7.1",
"product": {
"name": "macOS",
"vendor": {
"name": "Apple",
"scada": false
}
}
},
{
"description": "visionOS\u00a02.1 versions ant\u00e9rieures \u00e0 2.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Apple",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-44194",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44194"
},
{
"name": "CVE-2024-44296",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44296"
},
{
"name": "CVE-2024-44257",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44257"
},
{
"name": "CVE-2024-44289",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44289"
},
{
"name": "CVE-2024-44155",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44155"
},
{
"name": "CVE-2024-44280",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44280"
},
{
"name": "CVE-2024-44254",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44254"
},
{
"name": "CVE-2024-44256",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44256"
},
{
"name": "CVE-2024-44235",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44235"
},
{
"name": "CVE-2024-44195",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44195"
},
{
"name": "CVE-2024-44281",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44281"
},
{
"name": "CVE-2024-44251",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44251"
},
{
"name": "CVE-2024-44287",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44287"
},
{
"name": "CVE-2024-44284",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44284"
},
{
"name": "CVE-2024-44277",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44277"
},
{
"name": "CVE-2024-44237",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44237"
},
{
"name": "CVE-2024-44261",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44261"
},
{
"name": "CVE-2024-44213",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44213"
},
{
"name": "CVE-2024-44293",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44293"
},
{
"name": "CVE-2024-44223",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44223"
},
{
"name": "CVE-2024-44295",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44295"
},
{
"name": "CVE-2024-44270",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44270"
},
{
"name": "CVE-2024-44215",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44215"
},
{
"name": "CVE-2024-44244",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44244"
},
{
"name": "CVE-2024-44275",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44275"
},
{
"name": "CVE-2024-44156",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44156"
},
{
"name": "CVE-2024-44255",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44255"
},
{
"name": "CVE-2024-44247",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44247"
},
{
"name": "CVE-2024-44159",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44159"
},
{
"name": "CVE-2024-44175",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44175"
},
{
"name": "CVE-2024-44218",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44218"
},
{
"name": "CVE-2024-44252",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44252"
},
{
"name": "CVE-2024-44197",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44197"
},
{
"name": "CVE-2024-44264",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44264"
},
{
"name": "CVE-2024-44259",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44259"
},
{
"name": "CVE-2024-44216",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44216"
},
{
"name": "CVE-2024-40851",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40851"
},
{
"name": "CVE-2024-44302",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44302"
},
{
"name": "CVE-2024-40855",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40855"
},
{
"name": "CVE-2024-38476",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38476"
},
{
"name": "CVE-2024-44267",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44267"
},
{
"name": "CVE-2024-44258",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44258"
},
{
"name": "CVE-2024-44196",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44196"
},
{
"name": "CVE-2024-44273",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44273"
},
{
"name": "CVE-2024-44122",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44122"
},
{
"name": "CVE-2024-44126",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44126"
},
{
"name": "CVE-2024-44278",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44278"
},
{
"name": "CVE-2024-38477",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-38477"
},
{
"name": "CVE-2024-44292",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44292"
},
{
"name": "CVE-2024-44239",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44239"
},
{
"name": "CVE-2024-40867",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40867"
},
{
"name": "CVE-2024-44137",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44137"
},
{
"name": "CVE-2024-44279",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44279"
},
{
"name": "CVE-2024-44263",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44263"
},
{
"name": "CVE-2024-44231",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44231"
},
{
"name": "CVE-2024-40858",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40858"
},
{
"name": "CVE-2024-44269",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44269"
},
{
"name": "CVE-2024-44260",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44260"
},
{
"name": "CVE-2024-44298",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44298"
},
{
"name": "CVE-2024-44236",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44236"
},
{
"name": "CVE-2024-44274",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44274"
},
{
"name": "CVE-2024-44283",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44283"
},
{
"name": "CVE-2024-44253",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44253"
},
{
"name": "CVE-2024-44285",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44285"
},
{
"name": "CVE-2024-44301",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44301"
},
{
"name": "CVE-2024-44265",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44265"
},
{
"name": "CVE-2024-44144",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44144"
},
{
"name": "CVE-2024-44297",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44297"
},
{
"name": "CVE-2024-44262",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44262"
},
{
"name": "CVE-2024-44222",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44222"
},
{
"name": "CVE-2024-44294",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44294"
},
{
"name": "CVE-2024-39573",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-39573"
},
{
"name": "CVE-2024-44282",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44282"
},
{
"name": "CVE-2024-44240",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44240"
},
{
"name": "CVE-2024-44211",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44211"
},
{
"name": "CVE-2024-44229",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-44229"
}
],
"initial_release_date": "2024-10-29T00:00:00",
"last_revision_date": "2024-10-29T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0929",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-10-29T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Apple. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Apple",
"vendor_advisories": [
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121566",
"url": "https://support.apple.com/en-us/121566"
},
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121568",
"url": "https://support.apple.com/en-us/121568"
},
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121565",
"url": "https://support.apple.com/en-us/121565"
},
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121564",
"url": "https://support.apple.com/en-us/121564"
},
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121563",
"url": "https://support.apple.com/en-us/121563"
},
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121569",
"url": "https://support.apple.com/en-us/121569"
},
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121567",
"url": "https://support.apple.com/en-us/121567"
},
{
"published_at": "2024-10-28",
"title": "Bulletin de s\u00e9curit\u00e9 Apple 121570",
"url": "https://support.apple.com/en-us/121570"
}
]
}
CVE-2024-44256 (GCVE-0-2024-44256)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:08 – Updated: 2026-04-02 18:25
VLAI
EPSS
Summary
The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to break out of its sandbox.
Severity
9.3 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- An app may be able to break out of its sandbox
- CWE-noinfo Not enough information
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mac_os",
"vendor": "apple",
"versions": [
{
"lessThan": "13.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.1",
"status": "affected",
"version": "14.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-31T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T03:55:40.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:26.784Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to break out of its sandbox."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to break out of its sandbox",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:25:12.365Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121564"
},
{
"url": "https://support.apple.com/en-us/121568"
},
{
"url": "https://support.apple.com/en-us/121570"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44256",
"datePublished": "2024-10-28T21:08:35.106Z",
"dateReserved": "2024-08-20T21:45:40.786Z",
"dateUpdated": "2026-04-02T18:25:12.365Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44257 (GCVE-0-2024-44257)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:08 – Updated: 2026-04-02 18:24
VLAI
EPSS
Summary
This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access sensitive user data.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- An app may be able to access sensitive user data
- CWE-922 - Insecure Storage of Sensitive Information
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44257",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T19:21:27.526082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-922",
"description": "CWE-922 Insecure Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T19:22:00.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:31.908Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An app may be able to access sensitive user data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access sensitive user data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:24:52.125Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121564"
},
{
"url": "https://support.apple.com/en-us/121568"
},
{
"url": "https://support.apple.com/en-us/121570"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44257",
"datePublished": "2024-10-28T21:08:34.236Z",
"dateReserved": "2024-08-20T21:45:40.786Z",
"dateUpdated": "2026-04-02T18:24:52.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44258 (GCVE-0-2024-44258)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:07 – Updated: 2026-04-02 18:12
VLAI
EPSS
Summary
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, tvOS 18.1, visionOS 2.1. Restoring a maliciously crafted backup file may lead to modification of protected system files.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- Restoring a maliciously crafted backup file may lead to modification of protected system files
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
8 references
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 17.7.1
(custom)
Affected: 0 , < 18.1 (custom) |
|
| Apple | tvOS |
Affected:
0 , < 18.1
(custom)
|
|
| Apple | visionOS |
Affected:
0 , < 2.1
(custom)
|
|
| apple | visionos |
Affected:
0 , < 2.1
(custom)
cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:* |
|
| apple | ipados |
Affected:
0 , < 17.7
(custom)
Affected: 18.0 , < 18.1 (custom) cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
|
| apple | iphone_os |
Affected:
0 , < 17.7
(custom)
Affected: 18.0 , < 18.1 (custom) cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:iphone:* |
|
| apple | tvos |
Affected:
0 , < 18.1
(custom)
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:apple:visionos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "visionos",
"vendor": "apple",
"versions": [
{
"lessThan": "2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipados",
"vendor": "apple",
"versions": [
{
"lessThan": "17.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "18.1",
"status": "affected",
"version": "18.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:iphone:*"
],
"defaultStatus": "unknown",
"product": "iphone_os",
"vendor": "apple",
"versions": [
{
"lessThan": "17.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "18.1",
"status": "affected",
"version": "18.0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "tvos",
"vendor": "apple",
"versions": [
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44258",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-06T13:36:29.728157Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-06T13:41:03.333Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:38.794Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/16"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/15"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/10"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "17.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "tvOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, tvOS 18.1, visionOS 2.1. Restoring a maliciously crafted backup file may lead to modification of protected system files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Restoring a maliciously crafted backup file may lead to modification of protected system files",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:12:19.071Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121563"
},
{
"url": "https://support.apple.com/en-us/121566"
},
{
"url": "https://support.apple.com/en-us/121567"
},
{
"url": "https://support.apple.com/en-us/121569"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44258",
"datePublished": "2024-10-28T21:07:58.858Z",
"dateReserved": "2024-08-20T21:45:40.786Z",
"dateUpdated": "2026-04-02T18:12:19.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44259 (GCVE-0-2024-44259)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:07 – Updated: 2026-04-02 18:07
VLAI
EPSS
Summary
This issue was addressed through improved state management. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1. An attacker may be able to misuse a trust relationship to download malicious content.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- An attacker may be able to misuse a trust relationship to download malicious content
- CWE-noinfo Not enough information
Assigner
References
9 references
Impacted products
7 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | Safari |
Affected:
0 , < 18.1
(custom)
|
|
| Apple | iOS and iPadOS |
Affected:
0 , < 17.7.1
(custom)
Affected: 0 , < 18.1 (custom) |
|
| Apple | macOS |
Affected:
0 , < 15.1
(custom)
|
|
| Apple | visionOS |
Affected:
0 , < 2.1
(custom)
|
|
| apple | visionos |
Affected:
0 , < 2.1
(custom)
cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:* |
|
| apple | ios |
Affected:
0 , < 17.7
(custom)
Affected: 0 , < 18.1 (custom) cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:* |
|
| apple | ipados |
Affected:
0 , < 17.7
(custom)
Affected: 0 , < 18.1 (custom) cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:apple:visionos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "visionos",
"vendor": "apple",
"versions": [
{
"lessThan": "2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:ios:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ios",
"vendor": "apple",
"versions": [
{
"lessThan": "17.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "ipados",
"vendor": "apple",
"versions": [
{
"lessThan": "17.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-31T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T03:55:41.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:45.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/19"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/10"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Safari",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "17.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "15.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed through improved state management. This issue is fixed in Safari 18.1, iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, visionOS 2.1. An attacker may be able to misuse a trust relationship to download malicious content."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker may be able to misuse a trust relationship to download malicious content",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:07:10.734Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121563"
},
{
"url": "https://support.apple.com/en-us/121564"
},
{
"url": "https://support.apple.com/en-us/121566"
},
{
"url": "https://support.apple.com/en-us/121567"
},
{
"url": "https://support.apple.com/en-us/121571"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44259",
"datePublished": "2024-10-28T21:07:39.566Z",
"dateReserved": "2024-08-20T21:45:40.786Z",
"dateUpdated": "2026-04-02T18:07:10.734Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44260 (GCVE-0-2024-44260)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:08 – Updated: 2026-04-02 18:26
VLAI
EPSS
Summary
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app with root privileges may be able to modify the contents of system files.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- A malicious app with root privileges may be able to modify the contents of system files
- CWE-noinfo Not enough information
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:apple:mac_os:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "mac_os",
"vendor": "apple",
"versions": [
{
"lessThan": "13.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.1",
"status": "affected",
"version": "14.0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44260",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-31T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-01T03:55:42.744Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:49.546Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app with root privileges may be able to modify the contents of system files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A malicious app with root privileges may be able to modify the contents of system files",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:26:57.158Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121564"
},
{
"url": "https://support.apple.com/en-us/121568"
},
{
"url": "https://support.apple.com/en-us/121570"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44260",
"datePublished": "2024-10-28T21:08:41.089Z",
"dateReserved": "2024-08-20T21:45:40.787Z",
"dateUpdated": "2026-04-02T18:26:57.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44261 (GCVE-0-2024-44261)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:08 – Updated: 2026-04-02 18:23
VLAI
EPSS
Summary
This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker may be able to view restricted content from the lock screen.
Severity
6.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- An attacker may be able to view restricted content from the lock screen
- CWE-noinfo Not enough information
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 17.7.1
(custom)
Affected: 0 , < 18.1 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T20:26:58.635223Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T20:29:07.581Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:52.471Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/10"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "17.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker may be able to view restricted content from the lock screen."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker may be able to view restricted content from the lock screen",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:23:01.134Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121563"
},
{
"url": "https://support.apple.com/en-us/121567"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44261",
"datePublished": "2024-10-28T21:08:28.457Z",
"dateReserved": "2024-08-20T21:45:40.787Z",
"dateUpdated": "2026-04-02T18:23:01.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44262 (GCVE-0-2024-44262)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:07 – Updated: 2026-04-02 18:11
VLAI
EPSS
Summary
This issue was addressed with improved redaction of sensitive information. This issue is fixed in visionOS 2.1. A user may be able to view sensitive user information.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- A user may be able to view sensitive user information
- CWE-noinfo Not enough information
Assigner
References
2 references
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44262",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T20:31:54.311122Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T20:32:26.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:53.952Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/16"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "visionOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "2.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved redaction of sensitive information. This issue is fixed in visionOS 2.1. A user may be able to view sensitive user information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A user may be able to view sensitive user information",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:11:29.571Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121566"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44262",
"datePublished": "2024-10-28T21:07:55.389Z",
"dateReserved": "2024-08-20T21:45:40.787Z",
"dateUpdated": "2026-04-02T18:11:29.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44263 (GCVE-0-2024-44263)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:07 – Updated: 2026-04-02 18:07
VLAI
EPSS
Summary
A logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to access user-sensitive data.
Severity
4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- An app may be able to access user-sensitive data
- CWE-922 - Insecure Storage of Sensitive Information
Assigner
References
2 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apple | iOS and iPadOS |
Affected:
0 , < 18.1
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44263",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-29T14:19:45.994798Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-922",
"description": "CWE-922 Insecure Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T19:43:35.159Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:55.419Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/9"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "iOS and iPadOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "18.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A logic issue was addressed with improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. An app may be able to access user-sensitive data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An app may be able to access user-sensitive data",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:07:56.907Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121563"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44263",
"datePublished": "2024-10-28T21:07:42.109Z",
"dateReserved": "2024-08-20T21:45:40.787Z",
"dateUpdated": "2026-04-02T18:07:56.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44264 (GCVE-0-2024-44264)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:08 – Updated: 2026-04-02 18:15
VLAI
EPSS
Summary
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app may be able to create symlinks to protected regions of the disk.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- A malicious app may be able to create symlinks to protected regions of the disk
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "macos",
"vendor": "apple",
"versions": [
{
"lessThan": "14.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "13.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T17:51:01.229193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T17:58:53.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:10:59.729Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. A malicious app may be able to create symlinks to protected regions of the disk."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "A malicious app may be able to create symlinks to protected regions of the disk",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:15:22.369Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121564"
},
{
"url": "https://support.apple.com/en-us/121568"
},
{
"url": "https://support.apple.com/en-us/121570"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44264",
"datePublished": "2024-10-28T21:08:06.383Z",
"dateReserved": "2024-08-20T21:45:40.788Z",
"dateUpdated": "2026-04-02T18:15:22.369Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-44265 (GCVE-0-2024-44265)
Vulnerability from cvelistv5 – Published: 2024-10-28 21:08 – Updated: 2026-04-02 18:14
VLAI
EPSS
Summary
The issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical access can input Game Controller events to apps running on a locked device.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- An attacker with physical access can input Game Controller events to apps running on a locked device
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "macos",
"vendor": "apple",
"versions": [
{
"lessThan": "14.7",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "13.7",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44265",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-30T19:01:05.958193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-30T19:02:59.153Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T22:11:04.140Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/13"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/12"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Oct/11"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "macOS",
"vendor": "Apple",
"versions": [
{
"lessThan": "13.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "14.7.1",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "15.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical access can input Game Controller events to apps running on a locked device."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "An attacker with physical access can input Game Controller events to apps running on a locked device",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T18:14:41.615Z",
"orgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"shortName": "apple"
},
"references": [
{
"url": "https://support.apple.com/en-us/121564"
},
{
"url": "https://support.apple.com/en-us/121568"
},
{
"url": "https://support.apple.com/en-us/121570"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "286789f9-fbc2-4510-9f9a-43facdede74c",
"assignerShortName": "apple",
"cveId": "CVE-2024-44265",
"datePublished": "2024-10-28T21:08:04.757Z",
"dateReserved": "2024-08-20T21:45:40.788Z",
"dateUpdated": "2026-04-02T18:14:41.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…