CVSS: 2.1EPSS: 0%CPEs: 33EXPL: 0CVE-2009-1680
https://notcve.org/view.php?id=CVE-2009-1680
Safari in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly clear the search history when it is cleared from the Settings application, which allows physically proximate attackers to obtain the search history. Safari en n Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1 no borra correctamente el historial de búsqueda cuando es borrada desde la configuración de la aplicación, permitiendo que atacantes próximos físicamente obtengan el historial de búsqueda. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://osvdb.org/55240 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35448 http://www.vupen.com/english/advisories/2009/1621 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2009-0958
https://notcve.org/view.php?id=CVE-2009-0958
Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 stores an exception for a hostname when the user accepts an untrusted Exchange server certificate, which causes it to be accepted without prompting in future usage and allows remote Exchange servers to obtain sensitive information such as credentials. Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1 guarda una excepción para un nombre de servidor (hostname) cuando el usuario acepta un certificado de servidor Exchange no confiable, provocando que sea aceptado en usos futuros sin consultar al usuario y permitiendo que servidores Exchange remotos obtengan información sensible como las credenciales de acceso. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://osvdb.org/55236 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35447 http://www.vupen.com/english/advisories/2009/1621 https://exchange.xforce.ibmcloud.com/vulnerabilities/51208 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 2%CPEs: 33EXPL: 0CVE-2009-1683
https://notcve.org/view.php?id=CVE-2009-1683
The Telephony component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted ICMP echo request, which triggers an assertion error related to a "logic issue." El componente Telephony en Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1 permite a atacantes remotos provocar una denegación de servicio (reinicializar el dispositivo) mediante una petición de eco ICMP manipulada, disparando un error de aserción relacionado con un "elemento lógico". • http://jvn.jp/en/jp/JVN87239696/index.html http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000040.html http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.vupen.com/english/advisories/2009/1621 •
CVSS: 7.1EPSS: 1%CPEs: 33EXPL: 0CVE-2009-0959
https://notcve.org/view.php?id=CVE-2009-0959
The MPEG-4 video codec in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to cause a denial of service (device reset) via a crafted MPEG-4 video file that triggers an "input validation issue." El codificador de vídeo MPEG-4 en Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1 permite a atacantes remotos provocar una denegación de servicio (reinicialización de dispositivo) mediante un fichero de vídeo MPEG-4 manipulado que dispara un "evento de validación de entrada". • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://osvdb.org/55237 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35433 http://www.vupen.com/english/advisories/2009/1621 https://exchange.xforce.ibmcloud.com/vulnerabilities/51211 • CWE-20: Improper Input Validation •
CVSS: 2.1EPSS: 0%CPEs: 33EXPL: 0CVE-2009-1679
https://notcve.org/view.php?id=CVE-2009-1679
The Profiles component in Apple iPhone OS 1.0 through 2.2.1 and iPhone OS for iPod touch 1.1 through 2.2.1, when installing a configuration profile, can replace the password policy from Exchange ActiveSync with a weaker password policy, which allows physically proximate attackers to bypass the intended policy. El componente Profiles en Apple iPhone OS v1.0 hasta v2.2.1 e iPhone OS para iPod touch v1.1 hasta v2.2.1, cuando instalan un perfil de configuración, puede reemplazar la política de contraseña desde Exchange ActiveSync por una política de contraseña débil, permitiendo a atacantes próximos físicamente eludir la política prevista. • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html http://osvdb.org/55239 http://support.apple.com/kb/HT3639 http://www.securityfocus.com/bid/35414 http://www.securityfocus.com/bid/35436 http://www.vupen.com/english/advisories/2009/1621 https://exchange.xforce.ibmcloud.com/vulnerabilities/51212 • CWE-264: Permissions, Privileges, and Access Controls •