VYPR
← Apple Inc.

Vendor CVEs

Apple Inc.

All CVEs

9,002 total · sorted by risk
  • CVE-2018-4309MedApr 3, 2019
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.02

    A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

  • CVE-2019-6229MedMar 5, 2019
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.01

    A logic issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to universal cross site scripting.

  • CVE-2019-6228MedMar 5, 2019
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.01

    A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3, Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack.

  • CVE-2018-16845MedNov 7, 2018
    Nginx
    Nginx
    risk 0.40cvss 6.1epss 0.10

    nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ngx_http_mp4_module, which might allow an attacker to cause infinite loop in a worker process, cause a worker process crash, or might result in worker process memory disclosure by using a specially crafted mp4 file.…

  • CVE-2018-4133MedApr 3, 2018
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.02

    An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the "WebKit" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

  • CVE-2017-7153MedApr 3, 2018
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.03

    An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue…

  • CVE-2017-2492MedApr 3, 2018
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "JavaScriptCore" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web…

  • CVE-2017-13819MedNov 13, 2017
    Apple Inc.
    macOS
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the "HelpViewer" component. A cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML by bypassing the Same Origin Policy for…

  • CVE-2017-7109MedOct 23, 2017
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. A cross-site…

  • CVE-2017-7059MedJul 20, 2017
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.01

    A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

  • CVE-2017-7038MedJul 20, 2017
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.04

    A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component.

  • CVE-2017-2549MedMay 22, 2017
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.02

    An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web…

  • CVE-2017-2497MedMay 22, 2017
    Apple Inc.
    Mac OS X
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. The issue involves the "iBooks" component. It allows remote attackers to trigger visits to arbitrary URLs via a crafted book.

  • CVE-2017-2475MedApr 2, 2017
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.02

    An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames…

  • CVE-2017-2393MedApr 2, 2017
    Apple Inc.
    Safari Reader
    risk 0.40cvss 6.1epss 0.02

    An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Safari Reader" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site.

  • CVE-2016-7762MedFeb 20, 2017
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.01

    An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the "WebKit" component, which allows XSS attacks against Safari.

  • CVE-2016-7609MedFeb 20, 2017
    Apple Inc.
    macOS
    risk 0.40cvss 6.2epss 0.00

    An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "AppleGraphicsPowerManagement" component. It allows local users to cause a denial of service (NULL pointer dereference) via unspecified vectors.

  • CVE-2016-7600MedFeb 20, 2017
    Apple Inc.
    macOS
    risk 0.40cvss 6.2epss 0.00

    An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the "OpenPAM" component, which allows local users to obtain sensitive information by leveraging mishandling of failed PAM authentication by a sandboxed app.

  • CVE-2016-4701MedSep 25, 2016
    Apple Inc.
    OS X
    risk 0.40cvss 6.2epss 0.00

    Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SO_EXECPATH environment variable.

  • CVE-2016-4618MedSep 25, 2016
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.01

    Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."

  • CVE-2016-4651MedJul 22, 2016
    Apple Inc.
    Safari
    risk 0.40cvss 6.1epss 0.03

    Cross-site scripting (XSS) vulnerability in the WebKit JavaScript bindings in Apple iOS before 9.3.3 and Safari before 9.1.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTTP/0.9 response, related to a "cross-protocol cross-site scripting (XPXSS)"…

  • CVE-2016-4585MedJul 22, 2016
    Apple Inc.
    Webkit
    risk 0.40cvss 6.1epss 0.03

    Cross-site scripting (XSS) vulnerability in the WebKit Page Loading implementation in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to inject arbitrary web script or HTML via an HTTP response specifying redirection that is mishandled…

  • CVE-2016-1760MedMar 29, 2016
    Apple Inc.
    iOS
    risk 0.40cvss 6.2epss 0.00

    The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an arbitrary app's events via a crafted app.

  • CVE-2016-1941MedJan 31, 2016
    Mozilla Corporation
    Firefox
    risk 0.40cvss 6.1epss 0.01

    The file-download dialog in Mozilla Firefox before 44.0 on OS X enables a certain button too quickly, which allows remote attackers to conduct clickjacking attacks via a crafted web site that triggers a single-click action in a situation where a double-click action was intended.

  • CVE-2014-4406MedSep 19, 2014
    Apple Inc.
    Xcode Server
    risk 0.40cvss 6.1epss 0.02

    Cross-site scripting (XSS) vulnerability in Xcode Server in CoreCollaboration in Apple OS X Server before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2026-28980higJun 12, 2026
    Apple Inc.
    SwiftNIO
    risk 0.39cvss —epss 0.00

    ### Summary The `HTTPDecoder` in `NIOHTTP1` enforces no limit on the total size of an HTTP/1 message's header block or on the number of header fields per message. A remote peer can submit an arbitrary number of small, valid headers in a single request and have them all…

  • CVE-2026-43671higJun 12, 2026
    Apple Inc.
    SwiftNIO
    risk 0.39cvss —epss 0.00

    ### Summary A program using swift-nio is vulnerable to a potential out-of-bounds write when attacker-controlled index or length values exceeding `UInt32.max` are passed to some `ByteBuffer` methods. This affects all swift-nio versions from 1.0.0 to 2.99.0. It is fixed in…

  • CVE-2025-46310MedFeb 11, 2026
    Apple Inc.
    macOS
    risk 0.39cvss 6.0epss 0.00

    This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26. An attacker with root privileges may be able to delete protected system files.

  • CVE-2025-43200MedKEVJun 16, 2025
    Apple Inc.
    macOS
    risk 0.39cvss 4.2epss 0.01

    This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3.1 and iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, visionOS 2.3.1, watchOS 11.3.1. A…

  • CVE-2023-48795MedDec 18, 2023
    SSH
    SSH
    risk 0.39cvss 5.9epss 0.93

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently…

  • CVE-2023-32369MedJun 23, 2023
    Apple Inc.
    macOS
    risk 0.39cvss 6.0epss 0.01

    A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.7.7, macOS Monterey 12.6.6, macOS Ventura 13.4. An app may be able to modify protected parts of the file system.

  • CVE-2023-28320MedMay 26, 2023
    Curl
    Curl
    risk 0.39cvss 5.9epss 0.03

    A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to time-out slow operations using `alarm()`…

  • CVE-2022-43552MedFeb 9, 2023
    Curl
    Curl
    risk 0.39cvss 5.9epss 0.03

    A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations. When getting denied to tunnel the specific protocols SMB or TELNET, curl…

  • CVE-2022-32208MedJul 7, 2022
    Curl
    Curl
    risk 0.39cvss 5.9epss 0.07

    When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

  • CVE-2022-22616MedMay 26, 2022
    Apple Inc.
    macOS
    risk 0.39cvss 5.5epss 0.08

    This issue was addressed with improved checks. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.

  • CVE-2022-24765MedApr 12, 2022
    Git
    Git
    risk 0.39cvss 6.0epss 0.01

    Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be…

  • CVE-2021-30833MedOct 28, 2021
    Apple Inc.
    macOS
    risk 0.39cvss 5.5epss 0.43

    This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.0.1. Unpacking a maliciously crafted archive may allow an attacker to write arbitrary files.

  • CVE-2021-23841MedFeb 16, 2021
    OpenSSL Project
    OpenSSL
    risk 0.39cvss 5.9epss 0.07

    The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field…

  • CVE-2020-24722MedOct 7, 2020
    Exposure Notifications Project
    Exposure Notifications
    risk 0.39cvss 5.9epss 0.02

    An issue was discovered in the GAEN (aka Google/Apple Exposure Notifications) protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack.…

  • CVE-2018-14879HigOct 3, 2019
    Tcpdump
    Tcpdump
    risk 0.39cvss 7.0epss 0.05

    The command-line argument parser in tcpdump before 4.9.3 has a buffer overflow in tcpdump.c:get_next_file().

  • CVE-2019-6209MedMar 5, 2019
    Apple Inc.
    tvOS
    risk 0.39cvss 5.5epss 0.06

    An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A malicious application may be able to determine kernel memory…

  • CVE-2019-6208MedMar 5, 2019
    Apple Inc.
    tvOS
    risk 0.39cvss 5.5epss 0.05

    A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious application may cause unexpected changes in memory shared between processes.

  • CVE-2017-17689MedMay 16, 2018
    Microsoft
    Outlook
    risk 0.39cvss 5.9epss 0.05

    The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

  • CVE-2017-17688MedMay 16, 2018
    Openpgp
    Openpgp
    risk 0.39cvss 5.9epss 0.06

    The OpenPGP specification allows a Cipher Feedback Mode (CFB) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. NOTE: third parties report that this is a problem in applications that mishandle the Modification Detection Code (MDC) feature…

  • CVE-2018-4090MedApr 3, 2018
    Apple Inc.
    watchOS
    risk 0.39cvss 5.5epss 0.06

    An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read…

  • CVE-2017-13869MedDec 25, 2017
    Apple Inc.
    tvOS
    risk 0.39cvss 5.5epss 0.09

    An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read…

  • CVE-2017-13868MedDec 25, 2017
    Apple Inc.
    tvOS
    risk 0.39cvss 5.5epss 0.08

    An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read…

  • CVE-2017-13865MedDec 25, 2017
    Apple Inc.
    tvOS
    risk 0.39cvss 5.5epss 0.07

    An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read…

  • CVE-2017-13855MedDec 25, 2017
    Apple Inc.
    tvOS
    risk 0.39cvss 5.5epss 0.08

    An issue was discovered in certain Apple products. iOS before 11.2 is affected. macOS before 10.13.2 is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read…

  • CVE-2017-13849MedNov 13, 2017
    Apple Inc.
    tvOS
    risk 0.39cvss 5.5epss 0.06

    An issue was discovered in certain Apple products. iOS before 11.1 is affected. tvOS before 11.1 is affected. watchOS before 4.1 is affected. The issue involves the "CoreText" component. It allows remote attackers to cause a denial of service (application crash) via a crafted…

Page 71 of 181