Apple

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-4696 1Apple 1Mac Os X May 6, 2026 Sep 25, 2016 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (NULL pointer dereference) via a crafted app.
CVE-2016-4694 1Apple 2Mac Os X Os X Server May 6, 2026 Sep 25, 2016 N/A· v4 9.1 CRITICAL· v3 7.5 HIGH· v2 The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data in the HTTP_PROXY en...Show more The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue, a related issue to CVE-2016-5387.Show less
CVE-2016-4658 2Apple Xmlsoft 5Iphone Os Libxml2Mac Os X+2 more May 6, 2026 Sep 25, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote att...Show more xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other products) does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free and memory corruption) via a crafted XML document.Show less
CVE-2016-4618 1Apple 2Iphone Os Safari May 6, 2026 Sep 25, 2016 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbitrary web script or HTML via a crafted web site, aka "Universal XSS (UXSS)."
CVE-2016-4611 1Apple 3Iphone Os SafariTvos May 6, 2026 Sep 25, 2016 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability tha...Show more WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4730, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.Show less
CVE-2016-4749 1Apple 1Iphone Os May 6, 2026 Sep 18, 2016 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 Printing UIKit in Apple iOS before 10 mishandles environment variables, which allows local users to discover cleartext AirPrint preview content by reading a temporary file.
CVE-2016-4747 1Apple 1Iphone Os May 6, 2026 Sep 18, 2016 N/A· v4 3.7 LOW· v3 4.3 MEDIUM· v2 Mail in Apple iOS before 10 mishandles certificates, which makes it easier for man-in-the-middle attackers to discover mail credentials via unspecified vectors.
CVE-2016-4746 1Apple 1Iphone Os May 6, 2026 Sep 18, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an uni...Show more The Keyboards component in Apple iOS before 10 does not properly use a cache for auto-correct suggestions, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging an unintended correction.Show less
CVE-2016-4741 1Apple 1Iphone Os May 6, 2026 Sep 18, 2016 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 The Assets component in Apple iOS before 10 allows man-in-the-middle attackers to block software updates via vectors related to lack of an HTTPS session for retrieving updates.
CVE-2016-4740 1Apple 1Iphone Os May 6, 2026 Sep 18, 2016 N/A· v4 2.9 LOW· v3 1.9 LOW· v2 Apple iOS before 10, when Handoff for Messages is used, does not ensure that a Messages signin has occurred before displaying messages, which might allow attackers to obtain sensitive information via unspecified vectors.
CVE-2016-4719 1Apple 2Iphone Os Watchos May 6, 2026 Sep 18, 2016 N/A· v4 5.5 MEDIUM· v3 4.3 MEDIUM· v2 The GeoServices component in Apple iOS before 10 and watchOS before 3 does not properly restrict access to PlaceData information, which allows attackers to discover physical locations via a crafted application.
CVE-2016-4705 1Apple 1Xcode May 6, 2026 Sep 18, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4704.
CVE-2016-4704 1Apple 1Xcode May 6, 2026 Sep 18, 2016 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4705.
CVE-2016-4620 1Apple 1Iphone Os May 6, 2026 Sep 18, 2016 N/A· v4 3.3 LOW· v3 4.3 MEDIUM· v2 The Sandbox Profiles component in Apple iOS before 10 does not properly restrict access to directory metadata for SMS draft directories, which allows attackers to discover text-message recipients via a crafted app.
CVE-2016-7153 5Apple GoogleMicrosoft+2 more 6Chrome EdgeFirefox+3 more May 6, 2026 Sep 6, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser c...Show more The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.Show less
CVE-2016-7152 5Apple GoogleMicrosoft+2 more 6Chrome EdgeFirefox+3 more May 6, 2026 Sep 6, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser co...Show more The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote attackers to obtain cleartext data by leveraging a web-browser configuration in which third-party cookies are sent, aka a "HEIST" attack.Show less
CVE-2016-4657 1Apple 1Iphone Os Apr 21, 2026 Aug 25, 2016 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CVE-2016-4656 1Apple 1Iphone Os Apr 21, 2026 Aug 25, 2016 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
CVE-2016-4655 1Apple 1Iphone Os Apr 21, 2026 Aug 25, 2016 N/A· v4 5.5 MEDIUM· v3 7.1 HIGH· v2 The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.
CVE-2016-4654 1Apple 1Iphone Os May 6, 2026 Aug 18, 2016 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 IOMobileFrameBuffer in Apple iOS before 9.3.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Previous 1...264265266...443 Next