CVE-2023-40299

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using the DYLD_INSERT_LIBRARIES environment variable.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-114

Affected software

No affected versions have been published.

Timeline

Published: Oct 4, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-40307.8A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to CVE-2023-403009.8NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.CVE-2023-403019.8NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.CVE-2023-403029.1NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability CVE-2023-403037.8GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin CVE-2023-403055.5GNU indent 2.2.13 has a heap-based buffer overflow in search_brace in indent.c via a crafted file.CVE-2023-403066.1SAP S/4HANA Manage Catalog Items and Cross-Catalog searches Fiori apps allow an attacker to redirect users to a malicious site due to insuff CVE-2023-403077.8An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a CVE-2023-403087.5SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption e CVE-2023-403099.8SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authe CVE-2023-403107.5SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, U CVE-2023-403114.8Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2