# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2022-22609 |
|
|
|
2022-03-18 |
2022-03-24 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
The issue was addressed with additional permissions checks. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3, watchOS 8.5. A malicious application may be able to read other applications' settings. |
2 |
CVE-2022-22585 |
59 |
|
|
2022-03-18 |
2022-03-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access a user's files. |
3 |
CVE-2021-30995 |
362 |
|
|
2021-08-24 |
2022-02-21 |
5.1 |
None |
Remote |
High |
Not required |
Partial |
Partial |
Partial |
A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, watchOS 8.3. A malicious application may be able to elevate privileges. |
4 |
CVE-2021-30984 |
362 |
|
Exec Code |
2021-08-24 |
2022-02-19 |
5.1 |
None |
Remote |
High |
Not required |
Partial |
Partial |
Partial |
A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution. |
5 |
CVE-2021-30966 |
668 |
|
|
2021-08-24 |
2021-12-29 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.1, watchOS 8.3, iOS 15.2 and iPadOS 15.2, tvOS 15.2. User traffic might unexpectedly be leaked to a proxy server despite PAC configurations. |
6 |
CVE-2021-30854 |
|
|
|
2021-08-24 |
2021-11-01 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
A logic issue was addressed with improved state management. This issue is fixed in tvOS 15, watchOS 8, iOS 15 and iPadOS 15. A sandboxed process may be able to circumvent sandbox restrictions. |
7 |
CVE-2021-30788 |
|
|
|
2021-09-08 |
2021-09-15 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
None |
Partial |
This issue was addressed with improved checks. This issue is fixed in iOS 14.7, macOS Big Sur 11.5, watchOS 7.6, tvOS 14.7, Security Update 2021-005 Mojave, Security Update 2021-004 Catalina. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents. |
8 |
CVE-2021-30720 |
287 |
|
|
2021-09-08 |
2021-09-22 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
A logic issue was addressed with improved restrictions. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Safari 14.1.1, macOS Big Sur 11.4, watchOS 7.5. A malicious website may be able to access restricted ports on arbitrary servers. |
9 |
CVE-2021-30715 |
|
|
DoS |
2021-09-08 |
2021-09-16 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. Processing a maliciously crafted message may lead to a denial of service. |
10 |
CVE-2021-30710 |
787 |
|
DoS Mem. Corr. |
2021-09-08 |
2021-09-16 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
None |
Partial |
A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 14.6, Security Update 2021-004 Mojave, iOS 14.6 and iPadOS 14.6, Security Update 2021-003 Catalina, macOS Big Sur 11.4, watchOS 7.5. A malicious application may cause a denial of service or potentially disclose memory contents. |
11 |
CVE-2021-1849 |
347 |
|
Bypass |
2021-09-08 |
2021-09-20 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An issue in code signature validation was addressed with improved checks. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5. A malicious application may be able to bypass Privacy preferences. |
12 |
CVE-2021-1809 |
125 |
|
Mem. Corr. |
2021-09-08 |
2021-09-16 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A memory corruption issue was addressed with improved validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. A malicious application may be able to read restricted memory. |
13 |
CVE-2021-1808 |
125 |
|
Mem. Corr. |
2021-09-08 |
2021-09-16 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A memory corruption issue was addressed with improved validation. This issue is fixed in Security Update 2021-002 Catalina, Security Update 2021-003 Mojave, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5, macOS Big Sur 11.3. An application may be able to read restricted memory. |
14 |
CVE-2021-1764 |
416 |
|
DoS |
2021-04-02 |
2021-04-09 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause a denial of service. |
15 |
CVE-2021-1761 |
|
|
DoS |
2021-04-02 |
2021-04-13 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A remote attacker may be able to cause a denial of service. |
16 |
CVE-2020-9994 |
|
|
|
2020-10-22 |
2020-10-26 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
A path handling issue was addressed with improved validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application may be able to overwrite arbitrary files. |
17 |
CVE-2020-9991 |
|
|
DoS |
2020-12-08 |
2021-03-09 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
This issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.0, iOS 14.0 and iPadOS 14.0, iCloud for Windows 7.21, tvOS 14.0. A remote attacker may be able to cause a denial of service. |
18 |
CVE-2020-9952 |
79 |
|
XSS |
2020-10-16 |
2020-12-23 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 14.0 and iPadOS 14.0, tvOS 14.0, watchOS 7.0, Safari 14.0, iCloud for Windows 11.4, iCloud for Windows 7.21. Processing maliciously crafted web content may lead to a cross site scripting attack. |
19 |
CVE-2020-9916 |
|
|
|
2020-10-16 |
2020-10-20 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
A URL Unicode encoding issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A malicious attacker may be able to conceal the destination of a URL. |
20 |
CVE-2020-9914 |
20 |
|
DoS |
2020-10-16 |
2020-10-20 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
An input validation issue existed in Bluetooth. This issue was addressed with improved input validation. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8. An attacker in a privileged network position may be able to perform denial of service attack using malformed Bluetooth packets. |
21 |
CVE-2020-9905 |
120 |
|
DoS Overflow |
2020-10-22 |
2020-10-27 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 13.6 and iPadOS 13.6, macOS Catalina 10.15.6, tvOS 13.4.8. A remote attacker may be able to cause a denial of service. |
22 |
CVE-2020-9843 |
79 |
|
XSS |
2020-06-09 |
2022-03-31 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to a cross site scripting attack. |
23 |
CVE-2020-9842 |
|
|
|
2020-06-09 |
2022-06-04 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
An entitlement parsing issue was addressed with improved parsing. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A malicious application could interact with system processes to access private information and perform privileged actions. |
24 |
CVE-2020-9839 |
362 |
|
+Priv |
2020-06-09 |
2022-06-02 |
5.1 |
None |
Remote |
High |
Not required |
Partial |
Partial |
Partial |
A race condition was addressed with improved state handling. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. An application may be able to gain elevated privileges. |
25 |
CVE-2020-9837 |
125 |
|
|
2020-06-09 |
2020-06-09 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5. A remote attacker may be able to leak memory. |
26 |
CVE-2020-9827 |
|
|
DoS |
2020-06-09 |
2020-06-10 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
A denial of service issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. A remote attacker may be able to cause a denial of service. |
27 |
CVE-2020-9808 |
119 |
|
Overflow Mem. Corr. |
2020-06-09 |
2021-07-21 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5. An application may be able to cause unexpected system termination or write kernel memory. |
28 |
CVE-2020-9805 |
79 |
|
XSS |
2020-06-09 |
2022-03-31 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting. |
29 |
CVE-2020-9794 |
125 |
|
DoS |
2020-06-09 |
2021-03-09 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
None |
Partial |
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A malicious application may cause a denial of service or potentially disclose memory contents. |
30 |
CVE-2020-9787 |
|
|
|
2020-10-22 |
2020-10-28 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, macOS Catalina 10.15.4, tvOS 13.4, watchOS 6.2. Some websites may not have appeared in Safari Preferences. |
31 |
CVE-2019-15165 |
770 |
|
|
2019-10-03 |
2022-04-08 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. |
32 |
CVE-2019-8854 |
|
|
|
2020-10-27 |
2020-10-30 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in macOS Catalina 10.15, watchOS 6, iOS 13, tvOS 13. A device may be passively tracked by its Wi-Fi MAC address. |
33 |
CVE-2019-8787 |
125 |
|
|
2019-12-18 |
2019-12-22 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A remote attacker may be able to leak memory. |
34 |
CVE-2019-8646 |
125 |
|
|
2019-12-18 |
2019-12-19 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to leak memory. |
35 |
CVE-2019-8633 |
20 |
|
|
2020-10-27 |
2020-10-28 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, iOS 12.3, tvOS 12.3, watchOS 5.3. An application may be able to read restricted memory. |
36 |
CVE-2019-8631 |
|
|
|
2020-10-27 |
2020-10-28 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra, iOS 12.3, tvOS 12.3. Users removed from an iMessage conversation may still be able to alter state. |
37 |
CVE-2019-8620 |
200 |
|
+Info |
2019-12-18 |
2019-12-20 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.3, tvOS 12.3, watchOS 5.2.1. A device may be passively tracked by its WiFi MAC address. |
38 |
CVE-2019-8530 |
|
|
|
2019-12-18 |
2020-08-24 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. A malicious application may be able to overwrite arbitrary files. |
39 |
CVE-2019-8516 |
20 |
|
DoS |
2019-12-18 |
2019-12-30 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously crafted string may lead to a denial of service. |
40 |
CVE-2018-4474 |
400 |
|
|
2020-10-27 |
2020-10-29 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure. |
41 |
CVE-2018-4436 |
295 |
|
|
2019-04-03 |
2019-04-05 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
A certificate validation issue existed in configuration profiles. This was addressed with additional checks. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2. |
42 |
CVE-2018-4398 |
20 |
|
|
2019-04-03 |
2019-04-05 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
An issue existed in the method for determining prime numbers. This issue was addressed by using pseudorandom bases for testing of primes. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1, iTunes 12.9.1, iCloud for Windows 7.8. |
43 |
CVE-2018-4369 |
20 |
|
|
2019-04-03 |
2019-04-05 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A logic issue was addressed with improved state management. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1. |
44 |
CVE-2018-4321 |
20 |
|
|
2019-04-03 |
2019-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12. |
45 |
CVE-2018-4293 |
20 |
|
|
2019-04-03 |
2019-04-05 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
A cookie management issue was addressed with improved checks. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2, iTunes 12.8 for Windows, iCloud for Windows 7.6. |
46 |
CVE-2018-4277 |
20 |
|
|
2019-01-11 |
2019-10-23 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. |
47 |
CVE-2018-4248 |
125 |
|
|
2019-04-03 |
2019-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An out-of-bounds read was addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2. |
48 |
CVE-2018-4203 |
125 |
|
|
2019-04-03 |
2019-04-04 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. |
49 |
CVE-2018-4192 |
362 |
|
Exec Code |
2018-06-08 |
2019-03-07 |
5.1 |
None |
Remote |
High |
Not required |
Partial |
Partial |
Partial |
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a race condition. |
50 |
CVE-2018-4185 |
200 |
|
+Info |
2019-01-11 |
2019-03-08 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In iOS before 11.3, tvOS before 11.3, watchOS before 4.3, and macOS before High Sierra 10.13.4, an information disclosure issue existed in the transition of program state. This issue was addressed with improved state handling. |