CVE-2023-40528

This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An app may be able to bypass Privacy preferences.

• CWE-284

• http://seclists.org/fulldisclosure/2024/Jan/37Third Party Advisory
• https://support.apple.com/en-us/HT213936Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213937Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213938Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT214058Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213936Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213937Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213938Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213940Release Notes, Vendor Advisory
• http://seclists.org/fulldisclosure/2024/Jan/37Third Party Advisory
• https://support.apple.com/en-us/HT213936Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213937Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213938Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT213940Release Notes, Vendor Advisory
• https://support.apple.com/en-us/HT214058Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213936Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213937Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213938Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT213940Release Notes, Vendor Advisory
• https://support.apple.com/kb/HT214058

Published

Jan 23, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40516LG Simple Editor Incorrect Permission Assignment Local Privi…7.8
• CVE-2023-40517LG SuperSign Media Editor ContentRestController getObject Di…7.5
• CVE-2023-40518LiteSpeed OpenLiteSpeed before 1.7.18 does not strictly vali…7.5
• CVE-2023-40519A cross-site scripting (XSS) vulnerability in the bpk-common…6.1
• CVE-2023-4052The Firefox updater created a directory writable by non-priv…6.5
• CVE-2023-40520The issue was addressed with improved checks. This issue is …3.3
• CVE-2023-40529This issue was addressed with improved redaction of sensitiv…2.4
• CVE-2023-4053A website could have obscured the full screen notification b…6.5
• CVE-2023-40530Improper authorization in handler for custom URL scheme issu…4.7
• CVE-2023-40531Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_…8
• CVE-2023-40532Path traversal vulnerability in Welcart e-Commerce versions …4.3
• CVE-2023-40533Rejected reason: This CVE ID is a duplicate of CVE-2022-4046…