Apple iOS vulnerabilities

CVE-2011-3434 [MEDIUM] CWE-255 CVE-2011-3434: The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application.

CVE-2015-3725 [MEDIUM] CWE-399 CVE-2015-3725: MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.

CVE-2011-0161 [MEDIUM] CWE-20 CVE-2011-0161: WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.s WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle the Attr.style accessor, which allows remote attackers to bypass the Same Origin Policy and inject Cascading Style Sheets (CSS) token sequences via a crafted web site.

CVE-2015-7050 [MEDIUM] CWE-200 CVE-2015-7050: WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows re WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.

CVE-2010-3259 [MEDIUM] CWE-200 CVE-2010-3259: WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53 WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, does not properly restrict read access to images derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive image data via a crafted web site.

CVE-2015-5855 [MEDIUM] CWE-200 CVE-2015-5855: Apple iOS before 9 allows attackers to discover the e-mail address of a player via a crafted Game Ce Apple iOS before 9 allows attackers to discover the e-mail address of a player via a crafted Game Center app.

CVE-2015-1125 [MEDIUM] CWE-17 CVE-2015-1125: The touch-events implementation in WebKit in Apple iOS before 8.3 allows remote attackers to trigger The touch-events implementation in WebKit in Apple iOS before 8.3 allows remote attackers to trigger an association between a tap and an unintended web resource via a crafted web site.

CVE-2015-5904 [MEDIUM] CWE-254 CVE-2015-5904: Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted web site.

CVE-2013-5152 [MEDIUM] CWE-20 CVE-2013-5152: Mobile Safari in Apple iOS before 7 allows remote attackers to spoof the URL bar via a crafted web s Mobile Safari in Apple iOS before 7 allows remote attackers to spoof the URL bar via a crafted web site.

CVE-2017-7144 [MEDIUM] CWE-275 CVE-2017-7144: An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is af An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to track Safari Private Browsing users by leveraging cookie mishandling.

CVE-2025-43280 [MEDIUM] CWE-940 CVE-2025-43280: The issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6 The issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an email could display remote images in Mail in Lockdown Mode.

CVE-2024-44274 [MEDIUM] CVE-2024-44274: The issue was addressed with improved authentication. This issue is fixed in iOS 17.7.1 and iPadOS 1 The issue was addressed with improved authentication. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, watchOS 11.1. An attacker with physical access to a locked device may be able to view sensitive user information.

CVE-2024-40818 [MEDIUM] CVE-2024-40818: This issue was addressed by restricting options offered on a locked device. This issue is fixed in i This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, watchOS 10.6. An attacker with physical access may be able to use Siri to access sensitive user data.

CVE-2014-4467 [MEDIUM] CWE-17 CVE-2014-4467: WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during t WebKit, as used in Apple iOS before 8.1.3, does not properly determine scrollbar boundaries during the rendering of FRAME elements, which allows remote attackers to spoof the UI via a crafted web site.

CVE-2014-1350 [MEDIUM] CWE-264 CVE-2014-1350: Settings in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended iClou Settings in Apple iOS before 7.1.2 allows physically proximate attackers to bypass an intended iCloud password requirement, and turn off the Find My iPhone service, by leveraging incorrect state management.

CVE-2024-23251 [MEDIUM] CWE-287 CVE-2024-23251: An authentication issue was addressed with improved state management. This issue is fixed in iOS 16. An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, watchOS 10.5. An attacker with physical access may be able to leak Mail account credentials.

CVE-2026-43811 [MEDIUM] CWE-362 CVE-2026-43811: A race condition was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 1 A race condition was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6. An app may be able to modify protected parts of the file system.

CVE-2022-32868 [MEDIUM] CVE-2022-32868: A logic issue was addressed with improved state management. This issue is fixed in Safari 16, iOS 16 A logic issue was addressed with improved state management. This issue is fixed in Safari 16, iOS 16, iOS 15.7 and iPadOS 15.7. A website may be able to track users through Safari web extensions.

CVE-2020-9978 [MEDIUM] CVE-2020-9978: This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11. This issue was addressed with improved setting propagation. This issue is fixed in macOS Big Sur 11.0.1, tvOS 14.0, macOS Big Sur 11.1, Security Update 2020-001 Catalina, Security Update 2020-007 Mojave, watchOS 7.0, iOS 14.0 and iPadOS 14.0. An attacker in a privileged network position may be able to unexpectedly alter application state.

CVE-2021-1872 [MEDIUM] CVE-2021-1872: A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPad A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5, watchOS 7.4, macOS Big Sur 11.3. Muting a CallKit call while ringing may not result in mute being enabled.