VYPR
← Apple Inc.

Vendor CVEs

Apple Inc.

All CVEs

9,002 total · sorted by risk
  • CVE-2016-7653LowFeb 20, 2017
    Apple Inc.
    iOS
    risk 0.16cvss 2.4epss 0.00

    An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "Media Player" component, which allows physically proximate attackers to obtain sensitive photo and contact information by leveraging lockscreen access.

  • CVE-2016-4593LowJul 22, 2016
    Apple Inc.
    iOS
    risk 0.16cvss 2.4epss 0.00

    The Siri Contacts component in Apple iOS before 9.3.3 allows physically proximate attackers to read arbitrary Contact card information via unspecified vectors.

  • CVE-2016-1852LowMay 20, 2016
    Apple Inc.
    iOS
    risk 0.16cvss 2.4epss 0.00

    Siri in Apple iOS before 9.3.2 does not block data detectors within results in the lock-screen state, which allows physically proximate attackers to obtain sensitive contact and photo information via unspecified vectors.

  • CVE-2024-44123LowOct 28, 2024
    Apple Inc.
    macOS
    risk 0.15cvss 2.3epss 0.00

    A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. A malicious app with root privileges may be able to access keyboard input and location information without user consent.

  • CVE-2025-43423LowNov 4, 2025
    Apple Inc.
    macOS
    risk 0.13cvss 2.0epss 0.00

    A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, visionOS 26.1. An attacker with physical access to an unlocked device paired with a Mac may be able…

  • CVE-2015-0235Jan 28, 2015
    glibc
    glibc
    risk 0.11cvss —epss 0.95

    Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."

  • CVE-2021-21300HigMar 9, 2021
    Git
    Git
    risk 0.10cvss 8.0epss 0.89

    Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a…

  • CVE-2008-0226Jan 10, 2008
    MySQL
    MySQL
    risk 0.10cvss —epss 0.92

    Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.

  • CVE-2007-2175Apr 24, 2007
    Apple Inc.
    Safari
    risk 0.10cvss —epss 0.84

    Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory…

  • CVE-2004-2687Dec 31, 2004
    Distcc
    Distcc
    risk 0.10cvss —epss 0.88

    distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.

  • CVE-2003-0201May 5, 2003
    Samba (software)
    Samba
    risk 0.10cvss —epss 0.84

    Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.

  • CVE-2002-0656Aug 12, 2002
    OpenSSL Project
    OpenSSL
    risk 0.10cvss —epss 0.90

    Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.

  • CVE-2014-8517Nov 17, 2014
    Luke Mewburn
    Tnftp
    risk 0.09cvss —epss 0.69

    The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect.

  • CVE-2005-0043May 2, 2005
    Apple Inc.
    iTunes
    risk 0.09cvss —epss 0.69

    Buffer overflow in Apple iTunes 4.7 allows remote attackers to execute arbitrary code via a long URL in (1) .m3u or (2) .pls playlist files.

  • CVE-2003-0050Mar 7, 2003
    Apple Inc.
    Quicktime Streaming Server
    risk 0.09cvss —epss 0.69

    parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.

  • CVE-2011-0257Aug 15, 2011
    Apple Inc.
    Quicktime
    risk 0.08cvss —epss 0.60

    Integer signedness error in Apple QuickTime before 7.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PnSize opcode in a PICT file that triggers a stack-based buffer overflow.

  • CVE-2010-1807Sep 10, 2010
    Webkitgtk
    Webkitgtk
    risk 0.08cvss —epss 0.61

    WebKit in Apple Safari 4.x before 4.1.2 and 5.x before 5.0.2; Android before 2.2; and webkitgtk before 1.2.6; does not properly validate floating-point data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted…

  • CVE-2006-0848Feb 22, 2006
    Apple Inc.
    Mac OS X
    risk 0.08cvss —epss 0.58

    The "Open 'safe' files after downloading" option in Safari on Apple Mac OS X allows remote user-assisted attackers to execute arbitrary commands by tricking a user into downloading a __MACOSX folder that contains metadata (resource fork) that invokes the Terminal, which…

  • CVE-2003-0694Oct 6, 2003
    Sendmail, Inc.
    Sendmail
    risk 0.08cvss —epss 0.66

    The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.

  • CVE-2015-7007Oct 23, 2015
    Apple Inc.
    Mac OS X
    risk 0.07cvss —epss 0.53

    Script Editor in Apple OS X before 10.11.1 allows remote attackers to bypass an intended user-confirmation requirement for AppleScript execution via unspecified vectors.

  • CVE-2011-3230Oct 14, 2011
    Apple Inc.
    Safari
    risk 0.07cvss —epss 0.50

    Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via a crafted web site.

  • CVE-2007-6165Nov 29, 2007
    Apple Inc.
    Mac OS X
    risk 0.07cvss —epss 0.45

    Mail in Apple Mac OS X Leopard (10.5.1) allows user-assisted remote attackers to execute arbitrary code via an AppleDouble attachment containing an apparently-safe file type and script in a resource fork, which does not warn the user that a separate program is going to be…

  • CVE-2007-2386May 24, 2007
    Apple Inc.
    Mac OS X
    risk 0.07cvss —epss 0.50

    Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to 10.4.9 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted UPnP Internet Gateway Device (IGD) packet.

  • CVE-2007-0015Jan 1, 2007
    Apple Inc.
    Quicktime
    risk 0.07cvss —epss 0.49

    Buffer overflow in Apple QuickTime 7.1.3 allows remote attackers to execute arbitrary code via a long rtsp:// URI.

  • CVE-2006-0395Aug 5, 2006
    Apple Inc.
    Mac OS X
    risk 0.07cvss —epss 0.54

    The Download Validation in Mail in Mac OS X 10.4 does not properly recognize attachment file types to warn a user of an unsafe type, which allows user-assisted remote attackers to execute arbitrary code via crafted file types.

  • CVE-2015-3783Aug 16, 2015
    Apple Inc.
    OS X
    risk 0.06cvss —epss 0.36

    SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

  • CVE-2014-1303Mar 26, 2014
    Apple Inc.
    Safari
    risk 0.06cvss —epss 0.35

    Heap-based buffer overflow in Apple Safari 7.0.2 allows remote attackers to execute arbitrary code and bypass a sandbox protection mechanism via unspecified vectors, as demonstrated by Liang Chen during a Pwn2Own competition at CanSecWest 2014.

  • CVE-2013-6420Dec 17, 2013
    PHP
    PHP
    risk 0.06cvss —epss 0.36

    The asn1_time_to_time_t function in ext/openssl/openssl.c in PHP before 5.3.28, 5.4.x before 5.4.23, and 5.5.x before 5.5.7 does not properly parse (1) notBefore and (2) notAfter timestamps in X.509 certificates, which allows remote attackers to execute arbitrary code or cause a…

  • CVE-2013-1017May 24, 2013
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.33

    Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file.

  • CVE-2012-3753Nov 9, 2012
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.35

    Buffer overflow in the plugin in Apple QuickTime before 7.7.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MIME type.

  • CVE-2012-3752Nov 9, 2012
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.36

    Multiple buffer overflows in Apple QuickTime before 7.7.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted style element in a QuickTime TeXML file.

  • CVE-2011-3026Feb 16, 2012
    Google
    Chrome
    risk 0.06cvss —epss 0.73

    Integer overflow in libpng, as used in Google Chrome before 17.0.963.56, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an integer truncation.

  • CVE-2011-1774Jul 21, 2011
    Apple Inc.
    Safari
    risk 0.06cvss —epss 0.43

    WebKit in Apple Safari before 5.0.6 has improper libxslt security settings, which allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via a crafted web site. NOTE: this may overlap CVE-2011-1425.

  • CVE-2010-1818Aug 31, 2010
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.43

    The IPersistPropertyBag2::Read function in QTPlugin.ocx in Apple QuickTime 6.x, 7.x before 7.6.8, and other versions allows remote attackers to execute arbitrary code via the _Marshaled_pUnk attribute, which triggers unmarshalling of an untrusted pointer.

  • CVE-2010-1799Aug 16, 2010
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.34

    Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

  • CVE-2007-6166Nov 29, 2007
    Apple Inc.
    Quicktime
    risk 0.06cvss —epss 0.42

    Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

  • CVE-2004-0430Jul 7, 2004
    Apple Inc.
    Mac OS X
    risk 0.06cvss —epss 0.41

    Stack-based buffer overflow in AppleFileServer for Mac OS X 10.3.3 and earlier allows remote attackers to execute arbitrary code via a LoginExt packet for a Cleartext Password User Authentication Method (UAM) request with a PathName argument that includes an AFPName type string…

  • CVE-2002-0659Aug 12, 2002
    OpenSSL Project
    OpenSSL
    risk 0.06cvss —epss 0.36

    The ASN1 library in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allows remote attackers to cause a denial of service via invalid encodings.

  • CVE-1999-1412Jun 3, 1999
    Apache
    HTTP Server
    risk 0.06cvss —epss 0.35

    A possible interaction between Apple MacOS X release 1.0 and Apache HTTP server allows remote attackers to cause a denial of service (crash) via a flood of HTTP GET requests to CGI programs, which generates a large number of processes.

  • CVE-2015-6908Sep 11, 2015
    OpenLDAP
    Openldap
    risk 0.05cvss —epss 0.20

    The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd.

  • CVE-2015-4148Jun 9, 2015
    PHP
    PHP
    risk 0.05cvss —epss 0.20

    The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data…

  • CVE-2014-8147May 25, 2015
    Unicode
    International Components for Unicode
    risk 0.05cvss —epss 0.23

    The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 uses an integer data type that is inconsistent with a header file, which allows remote attackers to cause…

  • CVE-2014-8146May 25, 2015
    Unicode
    International Components for Unicode
    risk 0.05cvss —epss 0.24

    The resolveImplicitLevels function in common/ubidi.c in the Unicode Bidirectional Algorithm implementation in ICU4C in International Components for Unicode (ICU) before 55.1 does not properly track directionally isolated pieces of text, which allows remote attackers to cause a…

  • CVE-2015-3073May 13, 2015
    Microsoft
    Windows
    risk 0.05cvss —epss 0.25

    Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062,…

  • CVE-2014-4492Jan 30, 2015
    Apple Inc.
    iOS
    risk 0.05cvss —epss 0.20

    libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as…

  • CVE-2013-5704Apr 15, 2014
    Apache
    HTTP Server
    risk 0.05cvss —epss 0.60

    The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as…

  • CVE-2014-1912Mar 1, 2014
    Python (programming language)
    Python
    risk 0.05cvss —epss 0.28

    Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.

  • CVE-2012-0663May 16, 2012
    Apple Inc.
    Quicktime
    risk 0.05cvss —epss 0.29

    Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML file.

  • CVE-2011-0222Jul 21, 2011
    Apple Inc.
    Safari
    risk 0.05cvss —epss 0.22

    WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

  • CVE-2011-0419May 16, 2011
    Apache
    HTTP Server
    risk 0.05cvss —epss 0.30

    Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris…

Page 112 of 181