CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apple : Security Vulnerabilities (CVSS score between 4 and 4.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2022-32208 787 2022-07-07 2023-01-05
4.3
 None Remote Medium Not required Partial None None
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
2 CVE-2022-32205 770 DoS 2022-07-07 2023-01-05
4.3
 None Remote Medium Not required None None Partial
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
3 CVE-2022-29048 352 CSRF 2022-04-12 2022-10-27
4.3
 None Remote Medium Not required None Partial None
A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.
4 CVE-2022-28739 125 2022-05-09 2022-11-08
4.3
 None Remote Medium Not required Partial None None
There is a buffer over-read in Ruby before 2.6.10, 2.7.x before 2.7.6, 3.x before 3.0.4, and 3.1.x before 3.1.2. It occurs in String-to-Float conversion, including Kernel#Float and String#to_f.
5 CVE-2022-26774 269 2022-05-26 2022-06-07
4.6
 None Local Low Not required Partial Partial Partial
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.
6 CVE-2022-26767 863 Bypass 2022-05-26 2022-06-08
4.3
 None Remote Medium Not required Partial None None
The issue was addressed with additional permissions checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to bypass Privacy preferences.
7 CVE-2022-26766 295 Bypass 2022-05-26 2022-06-08
4.3
 None Remote Medium Not required None Partial None
A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A malicious app may be able to bypass signature validation.
8 CVE-2022-26755 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required None Partial None
This issue was addressed with improved environment sanitization. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to break out of its sandbox.
9 CVE-2022-26746 Bypass 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required Partial None None
This issue was addressed by removing the vulnerable code. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to bypass Privacy preferences.
10 CVE-2022-26745 787 Mem. Corr. 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required Partial None None
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.6.6. A malicious application may disclose restricted memory.
11 CVE-2022-26731 2022-05-26 2023-01-09
4.3
 None Remote Medium Not required Partial None None
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. A malicious website may be able to track users in Safari private browsing mode.
12 CVE-2022-26728 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required Partial None None
This issue was addressed with improved entitlements. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to access restricted files.
13 CVE-2022-26727 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required None Partial None
This issue was addressed with improved entitlements. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4. A malicious application may be able to modify protected parts of the file system.
14 CVE-2022-26726 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required None Partial None
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-004 Catalina, watchOS 8.6, macOS Monterey 12.4, macOS Big Sur 11.6.6. An app may be able to capture a user's screen.
15 CVE-2022-26712 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required None Partial None
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be able to modify protected parts of the file system.
16 CVE-2022-26706 2022-05-26 2022-06-07
4.3
 None Remote Medium Not required None Partial None
An access issue was addressed with additional sandbox restrictions on third-party applications. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS Monterey 12.4. A sandboxed process may be able to circumvent sandbox restrictions.
17 CVE-2022-26688 59 2022-05-26 2022-06-08
4.9
 None Local Low Not required None Complete None
An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious app with root privileges may be able to modify the contents of system files.
18 CVE-2022-23308 416 2022-02-26 2022-11-02
4.3
 None Remote Medium Not required None None Partial
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes.
19 CVE-2022-22676 20 2022-05-26 2022-06-08
4.3
 None Remote Medium Not required None Partial None
An event handler validation issue in the XPC Services API was addressed by removing the service. This issue is fixed in macOS Monterey 12.2. An application may be able to delete files for which it does not have permission.
20 CVE-2022-22674 125 2022-05-26 2022-06-08
4.9
 None Local Low Not required Complete None None
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in macOS Monterey 12.3.1, Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. A local user may be able to read kernel memory.
21 CVE-2022-22670 2022-03-18 2022-03-24
4.3
 None Remote Medium Not required None Partial None
An access issue was addressed with improved access restrictions. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, watchOS 8.5. A malicious application may be able to identify what other applications a user has installed.
22 CVE-2022-22663 863 Bypass 2022-05-26 2022-06-08
4.3
 None Remote Medium Not required None Partial None
This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in iOS 15.4 and iPadOS 15.4, Security Update 2022-004 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.6. A malicious application may bypass Gatekeeper checks.
23 CVE-2022-22662 668 2022-05-26 2022-09-04
4.3
 None Remote Medium Not required Partial None None
A cookie management issue was addressed with improved state management. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5. Processing maliciously crafted web content may disclose sensitive user information.
24 CVE-2022-22660 20 2022-03-18 2022-03-24
4.3
 None Remote Medium Not required None Partial None
This issue was addressed with a new entitlement. This issue is fixed in macOS Monterey 12.3. An app may be able to spoof system notifications and UI.
25 CVE-2022-22659 +Info 2022-03-18 2022-03-24
4.0
 None Remote Low ??? Partial None None
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.4 and iPadOS 15.4. An attacker in a privileged network position may be able to leak sensitive user information.
26 CVE-2022-22654 20 2022-03-18 2022-03-24
4.3
 None Remote Medium Not required None Partial None
A user interface issue was addressed. This issue is fixed in watchOS 8.5, Safari 15.4. Visiting a malicious website may lead to address bar spoofing.
27 CVE-2022-22644 2022-03-18 2022-03-24
4.3
 None Remote Medium Not required Partial None None
A privacy issue existed in the handling of Contact cards. This was addressed with improved state management. This issue is fixed in macOS Monterey 12.3. A malicious application may be able to access information about a user's contacts.
28 CVE-2022-22638 476 DoS 2022-03-18 2022-11-02
4.0
 None Remote Low ??? None None Partial
A null pointer dereference was addressed with improved validation. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Big Sur 11.6.5, Security Update 2022-003 Catalina, watchOS 8.5, macOS Monterey 12.3. An attacker in a privileged position may be able to perform a denial of service attack.
29 CVE-2022-22631 787 +Priv 2022-03-18 2022-11-02
4.6
 None Local Low Not required Partial Partial Partial
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. An application may be able to gain elevated privileges.
30 CVE-2022-22618 863 Bypass 2022-03-18 2022-03-28
4.6
 None Local Low Not required Partial Partial Partial
This issue was addressed with improved checks. This issue is fixed in watchOS 8.5, iOS 15.4 and iPadOS 15.4. A user may be able to bypass the Emergency SOS passcode prompt.
31 CVE-2022-22617 269 +Priv 2022-03-18 2022-11-02
4.6
 None Local Low Not required Partial Partial Partial
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. An application may be able to gain elevated privileges.
32 CVE-2022-22616 863 Bypass 2022-05-26 2022-06-08
4.3
 None Remote Medium Not required None Partial None
This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
33 CVE-2022-22600 Bypass 2022-03-18 2022-03-23
4.3
 None Remote Medium Not required None Partial None
The issue was addressed with improved permissions logic. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3, watchOS 8.5. A malicious application may be able to bypass certain Privacy preferences.
34 CVE-2022-22594 346 2022-03-18 2022-03-28
4.3
 None Remote Medium Not required Partial None None
A cross-origin issue in the IndexDB API was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. A website may be able to track sensitive user information.
35 CVE-2022-22592 2022-03-18 2022-09-09
4.3
 None Remote Medium Not required None Partial None
A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.
36 CVE-2022-22589 20 2022-03-18 2022-10-06
4.3
 None Remote Medium Not required None Partial None
A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted mail message may lead to running arbitrary javascript.
37 CVE-2022-22588 400 DoS 2022-03-18 2022-03-24
4.3
 None Remote Medium Not required None None Partial
A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 15.2.1 and iPadOS 15.2.1. Processing a maliciously crafted HomeKit accessory name may cause a denial of service.
38 CVE-2022-1769 126 2022-05-17 2022-10-31
4.6
 None Local Low Not required Partial Partial Partial
Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974.
39 CVE-2022-1733 787 Overflow 2022-05-17 2022-10-31
4.6
 None Local Low Not required Partial Partial Partial
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4968.
40 CVE-2022-1674 476 DoS 2022-05-12 2022-12-02
4.3
 None Remote Medium Not required None None Partial
NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input.
41 CVE-2022-1622 125 2022-05-11 2022-11-07
4.3
 None Remote Medium Not required None None Partial
LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa.
42 CVE-2022-1420 823 2022-04-21 2022-11-04
4.3
 None Remote Medium Not required None None Partial
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774.
43 CVE-2022-0943 122 Overflow 2022-03-14 2022-12-14
4.6
 None Local Low Not required Partial Partial Partial
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
44 CVE-2022-0714 122 Overflow 2022-02-22 2022-12-02
4.3
 None Remote Medium Not required None None Partial
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
45 CVE-2022-0696 476 2022-02-21 2022-11-29
4.3
 None Remote Medium Not required None None Partial
NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
46 CVE-2022-0530 Exec Code 2022-02-09 2022-09-30
4.3
 None Remote Medium Not required None None Partial
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
47 CVE-2022-0351 119 Overflow 2022-01-25 2022-11-09
4.6
 None Local Low Not required Partial Partial Partial
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
48 CVE-2022-0319 125 2022-01-21 2022-11-09
4.3
 None Remote Medium Not required Partial None None
Out-of-bounds Read in vim/vim prior to 8.2.
49 CVE-2022-0158 122 Overflow 2022-01-10 2022-08-26
4.3
 None Remote Medium Not required Partial None None
vim is vulnerable to Heap-based Buffer Overflow
50 CVE-2022-0156 416 2022-01-10 2022-08-26
4.3
 None Remote Medium Not required None None Partial
vim is vulnerable to Use After Free
Total number of vulnerabilities : 1146   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.