CVE-2023-40070

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-284CWE-1220

Affected software

VendorProductVersions
n/aIntel(R) Power Gadget software for macOSSee references
intelpower_gadget_software*

References

Timeline

Published
May 16, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-400717.8Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enableCVE-2023-400728.8OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS commaCVE-2023-400735.5In visitUris of Notification.java, there is a possible cross-user media read due to Confused Deputy. This could lead to local information diCVE-2023-400745.5In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additional execution privilegeCVE-2023-400755.5In forceReplaceShortcutInner of ShortcutPackage.java, there is a possible way to register unlimited packages due to a missing bounds check. CVE-2023-400765.5In createPendingIntent of CredentialManagerUi.java, there is a possible way to access credentials from other users due to a permissions bypaCVE-2023-400778.1In multiple functions of MetaDataBase.cpp, there is a possible UAF write due to a race condition. This could lead to remote escalation of prCVE-2023-400789.8In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overfCVE-2023-400797.8In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass. This could leCVE-2023-40089.8An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 beforeCVE-2023-400807.8In multiple functions of btm_ble_gap.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local CVE-2023-400815.5In loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another user's images due to a confused deputy. T
CVE-2023-40070: High severity, CVSS 8.8 | Vulnix