Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
Integer overflow in Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via crafted (1) title and (2) author fields in an SMIL file, related to improper calculations for memory alloca...
CVEs:CVE-2007-2394
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via ...
CVEs:CVE-2007-3944
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| safari | affected | apple | — | — |
| webkit | affected | apple | — | — |
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.
CVEs:CVE-2007-3798
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
| mac_os_x_server | affected | apple | — | — |
The JDirect support in QuickTime for Java in Apple Quicktime before 7.2 exposes certain dangerous interfaces, which allows remote attackers to execute arbitrary code via crafted Java applets.
CVEs:CVE-2007-2396
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
QuickTime for Java in Apple Quicktime before 7.2 does not properly check permissions, which allows remote attackers to disable security controls and execute arbitrary code via crafted Java applets.
CVEs:CVE-2007-2397
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
The design of QuickTime for Java in Apple Quicktime before 7.2 allows remote attackers to bypass certain security controls and write to process memory via Java applets, possibly leading to arbitrary code execution.
CVEs:CVE-2007-2393
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Apple Quicktime before 7.2 on Mac OS X 10.3.9 and 10.4.9 allows user-assisted remote attackers to execute arbitrary code via a crafted movie file that triggers memory corruption.
CVEs:CVE-2007-2392
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
The CUPS service, as used in SUSE Linux before 20070720 and other Linux distributions, allows remote attackers to cause a denial of service via unspecified vectors related to an incomplete fix for CVE-2007-0720 that introduced a different denial of ser...
CVEs:CVE-2007-4045
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| cups | affected | apple | — | — |
Unspecified vulnerability in mDNSResponder in Apple Mac OS X allows remote attackers to execute arbitrary code via unspecified vectors, a related issue to CVE-2007-2386.
CVEs:CVE-2007-3828
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
QuickTime for Java in Apple Quicktime before 7.2 does not perform sufficient "access control," which allows remote attackers to obtain sensitive information (screen content) via crafted Java applets.
CVEs:CVE-2007-2402
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| quicktime | affected | apple | — | — |
Multiple unspecified vulnerabilities in the SVG parsing engine in Apple Safari 3 Beta for Windows have unspecified remote attack vectors and impact. NOTE: this issue contains no actionable information, but it was released by a reliable researcher.
CVEs:CVE-2007-3718
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| safari | affected | apple | — | — |
Cross-domain vulnerability in Apple Safari for Windows 3.0.2 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the docu...
CVEs:CVE-2007-3514
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| safari | affected | apple | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.