CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple : Security Vulnerabilities (CVSS score between 4 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2013-0977 Bypass 2013-03-20 2013-03-21
4.6
 None Local Low Not required Partial Partial Partial
dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.
2 CVE-2013-0970 Bypass 2013-03-15 2013-03-15
4.3
 None Remote Medium Not required None Partial None
Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL.
3 CVE-2013-0969 264 Bypass 2013-03-15 2013-03-18
4.9
 None Local Low Not required None Complete None
Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard.
4 CVE-2013-0967 Bypass 2013-03-15 2013-03-18
4.3
 None Remote Medium Not required None Partial None
CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site.
5 CVE-2012-5851 79 XSS Bypass 2012-11-15 2012-11-19
4.3
 None Remote Medium Not required None Partial None
html/parser/XSSAuditor.cpp in WebCore in WebKit, as used in Google Chrome through 22 and Safari 5.1.7, does not consider all possible output contexts of reflected data, which makes it easier for remote attackers to bypass a cross-site scripting (XSS) protection mechanism via a crafted string, aka rdar problem 12019108.
6 CVE-2012-3746 310 2012-09-20 2013-03-25
4.3
 None Remote Medium Not required Partial None None
UIWebView in UIKit in Apple iOS before 6 does not properly use the Data protection feature, which allows context-dependent attackers to obtain cleartext file content by leveraging direct access to a device's filesystem.
7 CVE-2012-3736 264 Bypass 2012-09-20 2012-09-21
4.6
 None Local Low Not required Partial Partial Partial
The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors related to ending a FaceTime call.
8 CVE-2012-3733 200 +Info 2012-09-20 2013-03-25
4.3
 None Remote Medium Not required Partial None None
Messages in Apple iOS before 6, when multiple iMessage e-mail addresses are configured, does not ensure that a reply's sender address matches the recipient address of the original message, which allows remote attackers to obtain potentially sensitive information about alternate e-mail addresses in opportunistic circumstances by reading a reply.
9 CVE-2012-3730 2012-09-20 2013-03-25
4.3
 None Remote Medium Not required None Partial None
Mail in Apple iOS before 6 does not properly handle reuse of Content-ID header values, which allows remote attackers to spoof attachments via a header value that was also used in a previous e-mail message, as demonstrated by a message from a different sender.
10 CVE-2012-3723 119 DoS Exec Code Overflow Mem. Corr. 2012-09-20 2013-03-22
4.6
 None Local Low Not required Partial Partial Partial
Apple Mac OS X before 10.7.5 does not properly handle the bNbrPorts field of a USB hub descriptor, which allows physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) by attaching a USB device.
11 CVE-2012-3720 255 2012-09-20 2012-09-21
4.3
 None Remote Medium Not required Partial None None
Mobile Accounts in Apple Mac OS X before 10.7.5 and 10.8.x before 10.8.2 saves password hashes for external-account use even if external accounts are not enabled, which might allow remote attackers to determine passwords via unspecified access to a mobile account.
12 CVE-2012-3715 310 +Info 2012-09-20 2013-03-22
4.3
 None Remote Medium Not required Partial None None
Apple Safari before 6.0.1 makes http requests for https URIs in certain circumstances involving a paste into the address bar, which allows user-assisted remote attackers to obtain sensitive information by sniffing the network.
13 CVE-2012-3714 264 2012-09-20 2013-03-21
4.3
 None Remote Medium Not required Partial None None
The Form Autofill feature in Apple Safari before 6.0.1 does not restrict the filled fields to the set of fields contained in an Autofill popover, which allows remote attackers to obtain the Me card from an Address Book via a crafted web site.
14 CVE-2012-3713 264 2012-09-20 2013-03-21
4.3
 None Remote Medium Not required Partial None None
Apple Safari before 6.0.1 does not properly handle the Quarantine attribute of HTML documents, which allows user-assisted remote attackers to read arbitrary files by leveraging the presence of a downloaded document.
15 CVE-2012-3696 20 2012-07-25 2013-03-21
4.3
 None Remote Medium Not required None Partial None
CRLF injection vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP request splitting attacks via a crafted web site that leverages improper WebSockets URI handling.
16 CVE-2012-3695 79 XSS 2012-07-25 2013-03-21
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML by leveraging improper URL canonicalization during the handling of the location.href property.
17 CVE-2012-3694 200 +Info 2012-07-25 2012-11-30
4.3
 None Remote Medium Not required Partial None None
WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to obtain sensitive information about full pathnames via a crafted web site.
18 CVE-2012-3690 264 2012-07-25 2012-07-26
4.3
 None Remote Medium Not required Partial None None
WebKit in Apple Safari before 6.0 does not properly handle drag-and-drop events, which allows user-assisted remote attackers to read arbitrary files via a crafted web site.
19 CVE-2012-3650 200 +Info 2012-07-25 2013-03-21
4.3
 None Remote Medium Not required Partial None None
WebKit in Apple Safari before 6.0 accesses uninitialized memory locations during the rendering of SVG images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
20 CVE-2012-2889 79 XSS 2012-09-26 2013-03-21
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Google Chrome before 22.0.1229.79 allows remote attackers to inject arbitrary web script or HTML via vectors involving frames, aka "Universal XSS (UXSS)."
21 CVE-2012-0681 310 2012-08-22 2013-04-01
4.3
 None Remote Medium Not required Partial None None
Apple Remote Desktop before 3.6.1 does not recognize the "Encrypt all network data" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network.
22 CVE-2012-0679 264 2012-07-25 2012-07-30
4.3
 None Remote Medium Not required Partial None None
Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL.
23 CVE-2012-0678 79 XSS 2012-07-25 2012-08-08
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL.
24 CVE-2012-0675 287 2012-05-10 2012-05-29
4.3
 None Remote Medium Not required Partial None None
Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authentication after this authentication method is first used, which allows remote attackers to read Time Capsule credentials by spoofing the backup volume.
25 CVE-2012-0674 20 2012-05-08 2012-05-08
4.3
 None Remote Medium Not required None Partial None
Safari in Apple iOS before 5.1.1 allows remote attackers to spoof the location bar's URL via a crafted web site.
26 CVE-2012-0652 200 +Info 2012-05-10 2012-10-30
4.9
 None Local Low Not required Complete None None
Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enabled, does not properly restrict what is written to the system log for network logins, which allows local users to obtain sensitive information by reading the log.
27 CVE-2012-0590 79 XSS 2012-03-08 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a drag-and-drop operation.
28 CVE-2012-0589 79 XSS 2012-03-08 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0586, CVE-2012-0587, and CVE-2012-0588.
29 CVE-2012-0588 79 XSS 2012-03-08 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0586, CVE-2012-0587, and CVE-2012-0589.
30 CVE-2012-0587 79 XSS 2012-03-08 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0586, CVE-2012-0588, and CVE-2012-0589.
31 CVE-2012-0586 79 XSS 2012-03-08 2012-10-30
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0587, CVE-2012-0588, and CVE-2012-0589.
32 CVE-2011-3998 79 XSS 2011-11-09 2011-11-16
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Apple WebObjects 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
33 CVE-2011-3844 20 2012-03-07 2012-03-08
4.3
 None Remote Medium Not required None Partial None
Apple Safari 5.0.5 does not properly implement the setInterval function, which allows remote attackers to spoof the address bar via a crafted web page.
34 CVE-2011-3452 200 +Info 2012-02-02 2012-02-03
4.3
 None Remote Medium Not required Partial None None
Internet Sharing in Apple Mac OS X before 10.7.3 does not preserve the Wi-Fi configuration across software updates, which allows remote attackers to obtain sensitive information by leveraging the lack of a WEP password for a Wi-Fi network.
35 CVE-2011-3447 200 +Info 2012-02-02 2012-02-03
4.3
 None Remote Medium Not required Partial None None
CFNetwork in Apple Mac OS X 10.7.x before 10.7.3 does not properly construct request headers during parsing of URLs, which allows remote attackers to obtain sensitive information via a malformed URL.
36 CVE-2011-3444 310 2012-02-02 2012-02-06
4.3
 None Remote Medium Not required Partial None None
Address Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon failure of encrypted connections, which allows remote attackers to read CardDAV data by terminating an encrypted connection and then sniffing the network.
37 CVE-2011-3441 200 +Info 2011-11-11 2012-02-03
4.3
 None Remote Medium Not required Partial None None
libinfo in Apple iOS before 5.0.1 does not properly formulate domain-name queries, which allows remote attackers to obtain sensitive information via a crafted DNS hostname.
38 CVE-2011-3434 255 +Info 2011-10-14 2011-10-20
4.3
 None Remote Medium Not required Partial None None
The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application.
39 CVE-2011-3426 79 XSS 2011-10-14 2012-07-26
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header.
40 CVE-2011-3422 20 2011-09-12 2012-02-03
4.3
 None Remote Medium Not required None Partial None
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
41 CVE-2011-3256 94 DoS Exec Code Mem. Corr. 2011-10-14 2012-12-18
4.3
 None Remote Medium Not required None Partial None
FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226.
42 CVE-2011-3255 255 +Info 2011-10-14 2012-01-11
4.3
 None Remote Medium Not required Partial None None
CFNetwork in Apple iOS before 5 stores AppleID credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application.
43 CVE-2011-3254 79 XSS 2011-10-14 2011-10-14
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in Calendar in Apple iOS before 5 allows remote attackers to inject arbitrary web script or HTML via an invitation note.
44 CVE-2011-3243 79 XSS 2011-10-14 2011-10-20
4.3
 None Remote Medium Not required None Partial None
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows.
45 CVE-2011-3220 200 +Info 2011-10-14 2012-01-13
4.3
 None Remote Medium Not required Partial None None
QuickTime in Apple Mac OS X before 10.7.2 does not properly process URL data handlers in movie files, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted file.
46 CVE-2011-3214 264 Bypass 2011-10-14 2012-01-13
4.6
 None Local Low Not required Partial Partial Partial
IOGraphics in Apple Mac OS X through 10.6.8 does not properly handle a locked-screen state in display sleep mode for an Apple Cinema Display, which allows physically proximate attackers to bypass the password requirement via unspecified vectors.
47 CVE-2011-3058 79 XSS 2012-03-30 2013-03-15
4.3
 None Remote Medium Not required None Partial None
Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
48 CVE-2011-1132 DoS 2011-06-24 2011-10-26
4.9
 None Local Low Not required None None Complete
The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a denial of service (NULL pointer dereference and reboot) via vectors involving socket options.
49 CVE-2011-1059 399 DoS 2011-02-22 2012-01-26
4.3
 None Remote Medium Not required None None Partial
Use-after-free vulnerability in WebCore in WebKit before r77705, as used in Google Chrome before 11.0.672.2 and other products, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that entice a user to resubmit a form, related to improper handling of provisional items by the HistoryController component, aka rdar problem 8938557.
50 CVE-2011-0419 399 DoS 2011-05-16 2012-10-29
4.3
 None Remote Medium Not required None None Partial
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.
Total number of vulnerabilities : 302   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.