CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple : Security Vulnerabilities (CVSS score between 5 and 5.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2014-5031 264 +Info 2014-07-29 2014-07-30
5.0
None Remote Low Not required Partial None None
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors.
2 CVE-2014-4436 94 DoS 2014-10-17 2014-10-21
5.4
None Remote High Not required None None Complete
IOHIDFamily in Apple OS X before 10.10 allows attackers to cause denial of service (out-of-bounds read operation) via a crafted application.
3 CVE-2014-4428 310 2014-10-17 2014-10-21
5.4
None Local Network Medium Not required Partial Partial Partial
Bluetooth in Apple OS X before 10.10 does not require encryption for HID Low Energy devices, which allows remote attackers to spoof a device by leveraging previous pairing.
4 CVE-2014-4427 264 Bypass 2014-10-17 2014-10-21
5.0
None Remote Low Not required None Partial None
App Sandbox in Apple OS X before 10.10 allows attackers to bypass a sandbox protection mechanism via the accessibility API.
5 CVE-2014-4417 20 DoS 2014-10-17 2014-10-21
5.4
None Remote High Not required None None Complete
Safari in Apple OS X before 10.10 allows remote attackers to cause a denial of service (universal Push Notification outage) via a web site that triggers an uncaught SafariNotificationAgent exception by providing a crafted Push Notification.
6 CVE-2014-4378 119 DoS Overflow +Info 2014-09-18 2014-09-23
5.8
None Remote Medium Not required Partial None Partial
CoreGraphics in Apple iOS before 8 and Apple TV before 7 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and application crash) via a crafted PDF document.
7 CVE-2014-4374 2014-09-18 2014-09-23
5.0
None Remote Low Not required Partial None None
NSXMLParser in Foundation in Apple iOS before 8 allows attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
8 CVE-2014-4366 255 +Info 2014-09-18 2014-09-18
5.0
None Remote Low Not required Partial None None
Mail in Apple iOS before 8 does not prevent sending a LOGIN command to a LOGINDISABLED IMAP server, which allows remote attackers to obtain sensitive cleartext information by sniffing the network.
9 CVE-2014-4363 255 +Info 2014-09-18 2014-09-23
5.0
None Remote Low Not required Partial None None
Safari in Apple iOS before 8 does not properly restrict the autofilling of passwords in forms, which allows remote attackers to obtain sensitive information via (1) an http web site, (2) an https web site with an unacceptable X.509 certificate, or (3) an IFRAME element.
10 CVE-2014-4362 200 +Info 2014-09-18 2014-09-18
5.0
None Remote Low Not required Partial None None
The Sandbox Profiles implementation in Apple iOS before 8 does not properly restrict the third-party app sandbox profile, which allows attackers to obtain sensitive Apple ID information via a crafted app.
11 CVE-2014-4361 200 +Info 2014-09-18 2014-09-18
5.0
None Remote Low Not required Partial None None
The Home & Lock Screen subsystem in Apple iOS before 8 does not properly restrict the private API for app prominence, which allows attackers to determine the frontmost app by leveraging access to a crafted background app.
12 CVE-2014-4354 264 Bypass 2014-09-18 2014-09-18
5.8
None Local Network Low Not required Partial Partial Partial
Apple iOS before 8 enables Bluetooth during all upgrade actions, which makes it easier for remote attackers to bypass intended access restrictions via a Bluetooth session.
13 CVE-2014-1383 264 Bypass 2014-07-01 2014-07-24
5.5
None Remote Low Single system Partial Partial None
Apple TV before 6.1.2 allows remote authenticated users to bypass an intended password requirement for iTunes Store purchase transactions via unspecified vectors.
14 CVE-2014-1361 200 +Info 2014-07-01 2014-07-24
5.0
None Remote Low Not required Partial None None
Secure Transport in Apple iOS before 7.1.2, Apple OS X before 10.9.4, and Apple TV before 6.1.2 does not ensure that a DTLS message is accepted only for a DTLS connection, which allows remote attackers to obtain potentially sensitive information from uninitialized process memory by providing a DTLS message within a TLS connection.
15 CVE-2014-1346 20 Bypass 2014-05-22 2014-07-24
5.0
None Remote Low Not required None Partial None
WebKit, as used in Apple Safari before 6.1.4 and 7.x before 7.0.4, does not properly interpret Unicode encoding, which allows remote attackers to spoof a postMessage origin, and bypass intended restrictions on sending a message to a connected frame or window, via crafted characters in a URL.
16 CVE-2014-1316 20 DoS 2014-04-23 2014-04-23
5.0
None Remote Low Not required None None Partial
Heimdal, as used in Apple OS X through 10.9.2, allows remote attackers to cause a denial of service (abort and daemon exit) via ASN.1 data encountered in the Kerberos 5 protocol.
17 CVE-2014-1297 20 Bypass 2014-04-02 2014-04-02
5.0
None Remote Low Not required Partial None None
WebKit, as used in Apple Safari before 6.1.3 and 7.x before 7.0.3, does not properly validate WebProcess IPC messages, which allows remote attackers to bypass a sandbox protection mechanism and read arbitrary files by leveraging WebProcess access.
18 CVE-2014-1286 DoS 2014-03-14 2014-03-14
5.0
None Remote Low Not required None None Partial
SpringBoard Lock Screen in Apple iOS before 7.1 allows remote attackers to cause a denial of service (lock-screen hang) by leveraging a state-management error.
19 CVE-2014-1285 264 Bypass 2014-03-14 2014-03-14
5.8
None Remote Medium Not required Partial Partial None
Springboard in Apple iOS before 7.1 allows physically proximate attackers to bypass intended access restrictions and read the home screen by leveraging an application crash during activation of an unactivated device.
20 CVE-2014-1282 264 Bypass 2014-03-14 2014-03-14
5.8
None Remote Medium Not required Partial Partial None
The Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass intended configuration-profile visibility requirements via a long name.
21 CVE-2014-1276 264 2014-03-14 2014-03-14
5.0
None Remote Low Not required Partial None None
IOKit HID Event in Apple iOS before 7.1 allows attackers to conduct user-action monitoring attacks against arbitrary apps via a crafted app that accesses an IOKit framework interface.
22 CVE-2014-1273 20 Bypass 2014-03-14 2014-03-14
5.8
None Remote Medium Not required Partial Partial None
dyld in Apple iOS before 7.1 and Apple TV before 6.1 allows attackers to bypass code-signing requirements by leveraging use of text-relocation instructions in a dynamic library.
23 CVE-2014-1267 20 Bypass 2014-03-14 2014-03-14
5.8
None Remote Medium Not required Partial Partial None
The Configuration Profiles component in Apple iOS before 7.1 and Apple TV before 6.1 does not properly evaluate the expiration date of a mobile configuration profile, which allows attackers to bypass intended access restrictions by using a profile after the date has passed.
24 CVE-2014-1242 310 2014-01-23 2014-01-30
5.8
None Remote Medium Not required None Partial Partial
Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream.
25 CVE-2013-6835 264 +Info 2014-03-14 2014-09-19
5.0
None Remote Low Not required Partial None None
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL.
26 CVE-2013-6114 189 1 DoS Overflow 2013-11-04 2014-01-13
5.0
None Remote Low Not required None None Partial
Integer overflow in the OZDocument::parseElement function in Apple Motion 5.0.7 allows remote attackers to cause a denial of service (application crash) via a (1) large or (2) small value in the subview attribute of a viewer element in a .motn file.
27 CVE-2013-5189 264 Bypass 2013-10-23 2013-10-24
5.8
None Remote Medium Not required Partial Partial None
Apple Mac OS X before 10.9 does not preserve a certain administrative system-preferences setting across software updates, which allows context-dependent attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended security configuration after the completion of an update.
28 CVE-2013-5184 399 DoS 2013-10-23 2013-10-24
5.7
None Local Network Medium Not required None None Complete
The kernel in Apple Mac OS X before 10.9 does not properly check for errors during the processing of multicast Wi-Fi packets, which allows remote attackers to cause a denial of service (system crash) by leveraging presence in an 802.11 network's coverage area.
29 CVE-2013-5182 310 2013-10-23 2013-10-24
5.0
None Remote Low Not required None Partial None
Mail in Apple Mac OS X before 10.9 allows remote attackers to spoof the existence of a cryptographic signature for an e-mail message by using the multipart/signed content type within an unsigned message.
30 CVE-2013-5178 264 2013-10-23 2014-03-05
5.0
None Remote Low Not required None Partial None
LaunchServices in Apple Mac OS X before 10.9 does not properly restrict Unicode characters in filenames, which allows context-dependent attackers to spoof file extensions via a crafted character sequence.
31 CVE-2013-5167 16 2013-10-23 2013-10-24
5.0
None Remote Low Not required None Partial None
CFNetwork in Apple Mac OS X before 10.9 does not properly support Safari's deletion of session cookies in response to a reset operation, which makes it easier for remote web servers to track users via Set-Cookie HTTP headers.
32 CVE-2013-5157 264 2013-09-19 2013-10-22
5.0
None Remote Low Not required None Partial None
The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon.
33 CVE-2013-5132 189 DoS 2013-09-07 2013-09-18
5.4
None Remote High Not required None None Complete
Apple AirPort Base Station Firmware before 7.6.4 does not properly handle incorrect frame lengths, which allows remote attackers to cause a denial of service (device crash) by associating with the access point and then sending a short frame.
34 CVE-2013-5130 200 +Info 2013-10-24 2013-10-24
5.0
None Remote Low Not required Partial None None
WebKit in Apple Safari before 6.1 disables the Private Browsing feature upon a launch of the Web Inspector, which makes it easier for context-dependent attackers to obtain browsing information by leveraging LocalStorage/ files.
35 CVE-2013-4616 255 2013-06-18 2013-10-25
5.8
User Local Network Low Not required Partial Partial Partial
The WifiPasswordController generateDefaultPassword method in Preferences in Apple iOS 6 and earlier relies on the UITextChecker suggestWordInLanguage method for selection of Wi-Fi hotspot WPA2 PSK passphrases, which makes it easier for remote attackers to obtain access via a brute-force attack that leverages the insufficient number of possible passphrases.
36 CVE-2013-3950 119 Overflow 2013-06-05 2013-10-30
5.0
None Remote Low Not required None Partial None
Stack-based buffer overflow in the openSharedCacheFile function in dyld.cpp in dyld in Apple iOS 5.1.x and 6.x through 6.1.3 makes it easier for attackers to conduct untethering attacks via a long string in the DYLD_SHARED_CACHE_DIR environment variable.
37 CVE-2013-1033 264 Bypass 2013-09-16 2013-09-18
5.5
None Remote Low Single system Partial Partial None
Screen Lock in Apple Mac OS X before 10.8.5 does not properly track sessions, which allows remote authenticated users to bypass locking by leveraging screen-sharing access.
38 CVE-2013-1028 20 +Info 2013-09-16 2013-09-26
5.8
None Remote Medium Not required Partial Partial None
The IPSec implementation in Apple Mac OS X before 10.8.5, when Hybrid Auth is used, does not verify X.509 certificates from security gateways, which allows man-in-the-middle attackers to spoof security gateways and obtain sensitive information via a crafted certificate.
39 CVE-2013-0974 Exec Code Bypass 2013-01-29 2013-02-05
5.1
None Remote High Not required Partial Partial Partial
StoreKit in Apple iOS before 6.1 does not properly handle the disabling of JavaScript within the preferences configuration of Mobile Safari, which allows remote attackers to bypass intended access restrictions and execute JavaScript code via a web site with a Smart App Banner.
40 CVE-2013-0957 264 Bypass 2013-09-19 2013-10-10
5.8
None Remote Medium Not required Partial Partial None
Data Protection in Apple iOS before 7 allows attackers to bypass intended limits on incorrect passcode entry, and consequently avoid a configured Erase Data setting, by leveraging the presence of an app in the third-party sandbox.
41 CVE-2012-4672 20 2012-08-25 2013-04-04
5.8
None Remote Medium Not required Partial Partial None
Apple iChat Server does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via responses for domains that were not asserted.
42 CVE-2012-3749 200 Bypass +Info 2012-11-03 2013-08-17
5.0
None Remote Low Not required Partial None None
The extensions APIs in the kernel in Apple iOS before 6.0.1 provide kernel addresses in responses that contain an OSBundleMachOHeaders key, which makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted app.
43 CVE-2012-3748 362 DoS Exec Code 2012-11-03 2013-09-17
5.1
None Remote High Not required Partial Partial Partial
Race condition in WebKit in Apple iOS before 6.0.1 and Safari before 6.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving JavaScript arrays.
44 CVE-2012-3745 119 DoS Overflow 2012-09-20 2013-03-25
5.0
None Remote Low Not required None None Partial
Off-by-one error in Telephony in Apple iOS before 6 allows remote attackers to cause a denial of service (buffer overflow and connectivity outage) via a crafted user-data header in an SMS message.
45 CVE-2012-3744 2012-09-20 2013-03-25
5.0
None Remote Low Not required None Partial None
Telephony in Apple iOS before 6 uses an SMS message's return address as the displayed sender address, which allows remote attackers to spoof text communication via a message in which the return address does not match the originating address.
46 CVE-2012-3743 264 +Info 2012-09-20 2013-03-25
5.0
None Remote Low Not required Partial None None
The System Logs implementation in Apple iOS before 6 does not restrict /var/log access by sandboxed apps, which allows remote attackers to obtain sensitive information via a crafted app that reads log files.
47 CVE-2012-3742 264 2012-09-20 2013-03-25
5.0
None Remote Low Not required None Partial None
Safari in Apple iOS before 6 does not properly restrict use of an unspecified Unicode character that looks similar to the https lock indicator, which allows remote attackers to spoof https connections by placing this character in the TITLE element of a web page.
48 CVE-2012-3724 200 +Info 2012-09-20 2013-03-22
5.0
None Remote Low Not required Partial None None
CFNetwork in Apple iOS before 6 does not properly identify the host portion of a URL, which allows remote attackers to obtain sensitive information by leveraging the construction of an HTTP request with an incorrect hostname derived from a malformed URL.
49 CVE-2012-3721 287 2012-09-20 2013-03-22
5.0
None Remote Low Not required Partial None None
Profile Manager in Apple Mac OS X before 10.7.5 does not properly perform authentication for the Device Management private interface, which allows attackers to enumerate managed devices via unspecified vectors.
50 CVE-2012-3698 264 2012-07-26 2012-07-31
5.0
None Remote Low Not required Partial None None
Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2) command-line tool.
Total number of vulnerabilities : 319   Page : 1 (This Page)2 3 4 5 6 7
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.