Apple iOS vulnerabilities

CVE-2015-1113 [LOW] CWE-200 CVE-2015-1113: The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone nu The Sandbox Profiles component in Apple iOS before 8.3 allows attackers to read the (1) telephone number or (2) e-mail address of a recent contact via a crafted app.

CVE-2014-1352 [LOW] CWE-264 CVE-2014-1352: Lock Screen in Apple iOS before 7.1.2 does not properly enforce the limit on failed passcode attempt Lock Screen in Apple iOS before 7.1.2 does not properly enforce the limit on failed passcode attempts, which makes it easier for physically proximate attackers to conduct brute-force passcode-guessing attacks via unspecified vectors.

CVE-2011-3440 [LOW] CWE-264 CVE-2011-3440: The Passcode Lock feature in Apple iOS before 5.0.1 on the iPad 2 does not properly implement the lo The Passcode Lock feature in Apple iOS before 5.0.1 on the iPad 2 does not properly implement the locked state, which allows physically proximate attackers to access data by opening a Smart Cover during power-off confirmation.

CVE-2018-4352 [LOW] CWE-200 CVE-2018-4352: A consistency issue existed in the handling of application snapshots. The issue was addressed with i A consistency issue existed in the handling of application snapshots. The issue was addressed with improved handling of notes deletions. This issue affected versions prior to iOS 12.

CVE-2020-9780 [LOW] CWE-212 CVE-2020-9780: The issue was resolved by clearing application previews when content is deleted. This issue is fixed The issue was resolved by clearing application previews when content is deleted. This issue is fixed in iOS 13.4 and iPadOS 13.4. A local user may be able to view deleted content in the app switcher.

CVE-2024-40822 [LOW] CWE-284 CVE-2024-40822: This issue was addressed by restricting options offered on a locked device. This issue is fixed in i This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. An attacker with physical access to a device may be able to access contacts from the lock screen.

CVE-2023-32390 [LOW] CWE-125 CVE-2023-32390: The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watch The issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, macOS Ventura 13.4. Photos belonging to the Hidden Photos Album could be viewed without authentication through Visual Lookup.

CVE-2023-32365 [LOW] CVE-2023-32365: The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, i The issue was addressed with improved checks. This issue is fixed in iOS 15.7.6 and iPadOS 15.7.6, iOS 16.5 and iPadOS 16.5. Shake-to-undo may allow a deleted photo to be re-surfaced without authentication.

CVE-2014-4460 [LOW] CWE-200 CVE-2014-4460: CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cac CFNetwork in Apple iOS before 8.1.1 and OS X before 10.10.1 does not properly clear the browsing cache upon a transition out of private-browsing mode, which makes it easier for physically proximate attackers to obtain sensitive information by reading cache files.

CVE-2009-1680 [LOW] CWE-200 CVE-2009-1680: Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly clear the search history when it is cleared from the Settings application, which allows physically proximate attackers to obtain the search history.

CVE-2015-5832 [LOW] CWE-200 CVE-2015-5832: The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from t The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, which might allow physically proximate attackers to obtain sensitive information via unspecified vectors.

CVE-2015-5892 [LOW] CWE-200 CVE-2015-5892: Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side p Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.

CVE-2015-7080 [LOW] CWE-200 CVE-2015-7080: Siri in Apple iOS before 9.2 allows physically proximate attackers to bypass an intended client-side Siri in Apple iOS before 9.2 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive content-notification information by listening to a device in the lock-screen state.

CVE-2012-3735 [LOW] CWE-200 CVE-2012-3735: The Passcode Lock implementation in Apple iOS before 6 does not properly interact with the "Slide to The Passcode Lock implementation in Apple iOS before 6 does not properly interact with the "Slide to Power Off" feature, which allows physically proximate attackers to see the most recently used third-party app by watching the device's screen.

CVE-2012-3731 [LOW] CVE-2012-3731: Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attach Mail in Apple iOS before 6 does not properly implement the Data Protection feature for e-mail attachments, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors.

CVE-2012-3739 [LOW] CWE-264 CVE-2012-3739: The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypa The Passcode Lock implementation in Apple iOS before 6 allows physically proximate attackers to bypass an intended passcode requirement via vectors involving use of the camera.

CVE-2012-3740 [LOW] CWE-264 CVE-2012-3740: The Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state, whic The Passcode Lock implementation in Apple iOS before 6 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement via unspecified vectors.

CVE-2014-4384 [LOW] CWE-22 CVE-2014-4384: Directory traversal vulnerability in the App Installation feature in Apple iOS before 8 allows local Directory traversal vulnerability in the App Installation feature in Apple iOS before 8 allows local users to install unverified apps by triggering code-signature validation of an unintended bundle.

CVE-2026-84490 [LOW] CWE-287 CVE-2026-84490: This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS This issue was addressed through improved state management. This issue is fixed in iOS 27 and iPadOS 27. An attacker with physical access to a locked device may be able to bypass Digital ID authentication when iPhone Mirroring is active.

CVE-2015-1097 [LOW] CWE-200 CVE-2015-1097: IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensi IOMobileFramebuffer in Apple iOS before 8.3 and Apple TV before 7.2 allows attackers to obtain sensitive information about kernel memory via a crafted app.