# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
1 |
CVE-2022-26773 |
|
|
|
2022-05-26 |
2022-06-07 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for which it does not have permission. |
2 |
CVE-2020-9916 |
|
|
|
2020-10-16 |
2023-01-09 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
A URL Unicode encoding issue was addressed with improved state management. This issue is fixed in iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. A malicious attacker may be able to conceal the destination of a URL. |
3 |
CVE-2020-9843 |
79 |
|
XSS |
2020-06-09 |
2023-01-09 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
An input validation issue was addressed with improved input validation. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to a cross site scripting attack. |
4 |
CVE-2020-9805 |
79 |
|
XSS |
2020-06-09 |
2023-01-09 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.5 and iPadOS 13.5, tvOS 13.4.5, watchOS 6.2.5, Safari 13.1.1, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. Processing maliciously crafted web content may lead to universal cross site scripting. |
5 |
CVE-2020-9794 |
125 |
|
DoS |
2020-06-09 |
2023-01-09 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
None |
Partial |
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 13.5 and iPadOS 13.5, macOS Catalina 10.15.5, tvOS 13.4.5, watchOS 6.2.5, iTunes 12.10.7 for Windows, iCloud for Windows 11.2, iCloud for Windows 7.19. A malicious application may cause a denial of service or potentially disclose memory contents. |
6 |
CVE-2018-4474 |
400 |
|
|
2020-10-27 |
2020-10-29 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
A memory consumption issue was addressed with improved memory handling. This issue is fixed in iCloud for Windows 7.7, watchOS 5, Safari 12, iOS 12, iTunes 12.9 for Windows, tvOS 12. Unexpected interaction causes an ASSERT failure. |
7 |
CVE-2018-4319 |
346 |
|
|
2019-04-03 |
2020-08-24 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
None |
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. |
8 |
CVE-2016-4743 |
119 |
|
DoS Overflow Mem. Corr. +Info |
2017-02-20 |
2017-07-27 |
5.8 |
None |
Remote |
Medium |
Not required |
Partial |
None |
Partial |
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption and application crash) via a crafted web site. |
9 |
CVE-2014-4452 |
399 |
|
DoS Exec Code Mem. Corr. |
2014-11-18 |
2019-07-16 |
5.4 |
None |
Local Network |
Medium |
Not required |
Partial |
Partial |
Partial |
WebKit, as used in Apple iOS before 8.1.1 and Apple TV before 7.0.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2014-4462. |
10 |
CVE-2014-1242 |
310 |
|
|
2014-01-23 |
2017-08-29 |
5.8 |
None |
Remote |
Medium |
Not required |
None |
Partial |
Partial |
Apple iTunes before 11.1.4 uses HTTP for the iTunes Tutorials window, which allows man-in-the-middle attackers to spoof content by gaining control over the client-server data stream. |
11 |
CVE-2011-3909 |
119 |
|
DoS Overflow Mem. Corr. |
2011-12-13 |
2020-05-07 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
The Cascading Style Sheets (CSS) implementation in Google Chrome before 16.0.912.63 on 64-bit platforms does not properly manage property arrays, which allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors. |
12 |
CVE-2011-3908 |
125 |
|
DoS |
2011-12-13 |
2020-05-08 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Google Chrome before 16.0.912.63 does not properly parse SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
13 |
CVE-2011-3234 |
125 |
|
DoS |
2011-09-19 |
2020-05-08 |
5.0 |
None |
Remote |
Low |
Not required |
None |
None |
Partial |
Google Chrome before 14.0.835.163 does not properly handle boxes, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. |
14 |
CVE-2006-1467 |
189 |
|
Exec Code Overflow |
2006-06-29 |
2018-10-18 |
5.1 |
None |
Remote |
High |
Not required |
Partial |
Partial |
Partial |
Integer overflow in the AAC file parsing code in Apple iTunes before 6.0.5 on Mac OS X 10.2.8 or later, and Windows XP and 2000, allows remote user-assisted attackers to execute arbitrary code via an AAC (M4P, M4A, or M4B) file with a sample table size (STSZ) atom with a "malformed" sample_size_table value. |