CVSS: 6.8EPSS: 0%CPEs: 30EXPL: 0CVE-2014-1366
https://notcve.org/view.php?id=CVE-2014-1366
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4. WebKit, utilizado en Apple iOS anterior a 7.1.2, Apple Safari anterior a 6.1.5 y 7.x anterior a 7.0.5, y Apple TV anterior a 6.1.2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de un sitio web manipulados, una vulnerabilidad diferente a otros CVEs de WebKit listados en APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, y APPLE-SA-2014-06-30-4. • http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html http://secunia.com/advisories/59481 http://www.securitytracker.com/id/1030495 https://support.apple.com/kb/HT6537 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 30EXPL: 0CVE-2014-1364
https://notcve.org/view.php?id=CVE-2014-1364
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4. WebKit, utilizado en Apple iOS anterior a 7.1.2, Apple Safari anterior a 6.1.5 y 7.x anterior a 7.0.5, y Apple TV anetrior a 6.1.2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de aplicación) a través de un sitio web manipulado, una vulnerabilidad diferente a otros CVEs de WebKit listados en APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, y APPLE-SA-2014-06-30-4. • http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html http://secunia.com/advisories/59481 http://www.securitytracker.com/id/1030495 https://support.apple.com/kb/HT6537 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 0%CPEs: 30EXPL: 0CVE-2014-1325
https://notcve.org/view.php?id=CVE-2014-1325
WebKit, as used in Apple iOS before 7.1.2, Apple Safari before 6.1.5 and 7.x before 7.0.5, and Apple TV before 6.1.2, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3, and APPLE-SA-2014-06-30-4. WebKit, utilizado en Apple iOS anterior a 7.1.2, Apple Safari anterior a 6.1.5 y 7.x anterior a 7.0.5, y Apple TV anterior a 6.1.2, permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de apliccación) a través de un sitio web manipulado, una vulnerabilidad diferente a otros CVEs de Webkit listados en APPLE-SA-2014-06-30-1, APPLE-SA-2014-06-30-3 y APPLE-SA-2014-06-30-4. • http://archives.neohapsis.com/archives/bugtraq/2014-06/0171.html http://archives.neohapsis.com/archives/bugtraq/2014-06/0174.html http://archives.neohapsis.com/archives/bugtraq/2014-06/0175.html http://secunia.com/advisories/59481 http://www.securitytracker.com/id/1030495 https://support.apple.com/kb/HT6537 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 5.0EPSS: 8%CPEs: 8EXPL: 1CVE-2013-6835 – Apple iOS 4.2.1 - 'facetime-audio://' Security Bypass
https://notcve.org/view.php?id=CVE-2013-6835
TelephonyUI Framework in Apple iOS 7 before 7.1, when Safari is used, does not require user confirmation for FaceTime audio calls, which allows remote attackers to obtain telephone number or e-mail address information via a facetime-audio: URL. TelephonyUI Framework en Apple iOS 7 anterior a 7.1, cuando Safari es utilizado, no requiere confirmación de usuario para llamadas de audio FaceTime, lo que permite a atacantes remotos obtener información de número de teléfono o dirección de email a través de una URL facetime-audio:. Facetime allows video calls for iOS. Facetime-Audio, added in iOS 7, allows audio only calls. The audio version uses a vulnerable URL scheme which is not used by Facetime Video. • https://www.exploit-db.com/exploits/39114 http://archives.neohapsis.com/archives/bugtraq/2014-09/0106.html http://seclists.org/bugtraq/2014/Mar/63 http://seclists.org/fulldisclosure/2014/Mar/92 http://support.apple.com/kb/HT6162 http://support.apple.com/kb/HT6441 http://www.securityfocus.com/bid/66108 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 0%CPEs: 81EXPL: 0CVE-2009-2200
https://notcve.org/view.php?id=CVE-2009-2200
WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document. WebKit en Apple Safari anteriores a v4.0.3 no restringe apropiadamente el esquema URL del atributo pluginspage de un elemento EMBED, lo que permite a los atacantes remotos asistidos por usuarios lanzar un archivo arbitrario: URLs y obtener información sensible a través de un documento HTML manipulado. • http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html http://secunia.com/advisories/43068 http://support.apple.com/kb/HT3733 http://www.securityfocus.com/bid/36024 http://www.securitytracker.com/id?1022720 http://www.vupen.com/english/advisories/2011/0212 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •