Apple iOS vulnerabilities

3,941 known vulnerabilities affecting apple/iphone_os.

Total CVEs

3,941

CISA KEV

actively exploited

Public exploits

248

Exploited in wild

Severity breakdown

CRITICAL313HIGH1610MEDIUM1731LOW287

Vulnerabilities

Page 178 of 198

CVE-2013-5138MEDIUMCVSS 4.7≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5138 [MEDIUM] CVE-2013-5138: IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service (NULL p IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted application.

nvd

CVE-2013-5145MEDIUMCVSS 6.3≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5145 [MEDIUM] CWE-264 CVE-2013-5145: kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messag kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messages, which allows local users to (1) load or (2) unload kernel extensions via a crafted message.

nvd

CVE-2013-1042MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-1042 [MEDIUM] CWE-119 CVE-2013-1042: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-5157MEDIUMCVSS 5.0≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5157 [MEDIUM] CWE-264 CVE-2013-5157: The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter da The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon.

nvd

CVE-2013-1046MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-1046 [MEDIUM] CWE-119 CVE-2013-1046: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-5156MEDIUMCVSS 4.3≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5156 [MEDIUM] CWE-264 CVE-2013-5156: The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephon The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attackers to bypass intended restrictions on phone calls via a crafted app that sends direct requests to the daemon.

nvd

CVE-2013-1037MEDIUMCVSS 6.8v1.0.0v1.0.1+48 more2013-09-19

CVE-2013-1037 [MEDIUM] CWE-119 CVE-2013-1037: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-5126MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5126 [MEDIUM] CWE-119 CVE-2013-5126: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-1040MEDIUMCVSS 6.8v1.0.0v1.0.1+48 more2013-09-19

CVE-2013-1040 [MEDIUM] CWE-119 CVE-2013-1040: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-1038MEDIUMCVSS 6.8v1.0.0v1.0.1+48 more2013-09-19

CVE-2013-1038 [MEDIUM] CWE-119 CVE-2013-1038: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-0957MEDIUMCVSS 5.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-0957 [MEDIUM] CWE-264 CVE-2013-0957: Data Protection in Apple iOS before 7 allows attackers to bypass intended limits on incorrect passco Data Protection in Apple iOS before 7 allows attackers to bypass intended limits on incorrect passcode entry, and consequently avoid a configured Erase Data setting, by leveraging the presence of an app in the third-party sandbox.

nvd

CVE-2013-5125MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5125 [MEDIUM] CWE-119 CVE-2013-5125: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-1044MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-1044 [MEDIUM] CWE-119 CVE-2013-1044: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-1036MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-1036 [MEDIUM] CWE-119 CVE-2013-1036: Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.

nvd

CVE-2011-2391MEDIUMCVSS 6.1≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2011-2391 [MEDIUM] CWE-20 CVE-2011-2391: The IPv6 implementation in the kernel in Apple iOS before 7 allows remote attackers to cause a denia The IPv6 implementation in the kernel in Apple iOS before 7 allows remote attackers to cause a denial of service (CPU consumption) via crafted ICMPv6 packets.

nvd

CVE-2013-1045MEDIUMCVSS 6.8≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-1045 [MEDIUM] CWE-119 CVE-2013-1045: WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

nvd

CVE-2013-5149MEDIUMCVSS 4.3≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5149 [MEDIUM] CWE-264 CVE-2013-5149: The Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an ap The Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an app without user approval, which allows attackers to obtain sensitive information via an app that employs a crafted push-notification registration process.

nvd

CVE-2013-5147LOWCVSS 3.7PoC≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5147 [LOW] CWE-362 CVE-2013-5147: Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card.

nvd

CVE-2013-5153LOWCVSS 2.1≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5153 [LOW] CWE-264 CVE-2013-5153: Springboard in Apple iOS before 7 does not properly manage the lock state in Lost Mode, which allows Springboard in Apple iOS before 7 does not properly manage the lock state in Lost Mode, which allows physically proximate attackers to read notifications via unspecified vectors.

nvd

CVE-2013-5150LOWCVSS 1.9≤ 6.1.4v1.0.0+46 more2013-09-19

CVE-2013-5150 [LOW] CWE-200 CVE-2013-5150: The history-clearing feature in Safari in Apple iOS before 7 does not clear the back/forward history The history-clearing feature in Safari in Apple iOS before 7 does not clear the back/forward history of an open tab, which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.

nvd

← Previous178 / 198Next →