Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as ...
CVEs:CVE-2011-1516
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document.
CVEs:CVE-2011-3439
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
The nonet and nointernet sandbox profiles in Apple Mac OS X 10.5.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of launchctl to trigg...
CVEs:CVE-2008-7303
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
Apple Type Services (ATS) in Apple Mac OS X before 10.7.3 does not properly manage memory for data-font files, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted font that is accessed ...
CVEs:CVE-2011-3446
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
| mac_os_x_server | affected | apple | — | — |
libinfo in Apple iOS before 5.0.1 does not properly formulate domain-name queries, which allows remote attackers to obtain sensitive information via a crafted DNS hostname.
CVEs:CVE-2011-3441
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
Use-after-free vulnerability in Google Chrome before 15.0.874.120 allows user-assisted remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to editing.
CVEs:CVE-2011-3897
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| itunes | affected | apple | — | — |
| safari | affected | apple | — | — |
Cross-site scripting (XSS) vulnerability in Apple WebObjects 5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVEs:CVE-2011-3998
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| webobjects | affected | apple | — | — |
The kernel in Apple iOS before 5.0.1 does not ensure the validity of flag combinations for an mmap system call, which allows local users to execute arbitrary unsigned code via a crafted app.
CVEs:CVE-2011-3442
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
The Passcode Lock feature in Apple iOS before 5.0.1 on the iPad 2 does not properly implement the locked state, which allows physically proximate attackers to access data by opening a Smart Cover during power-off confirmation.
CVEs:CVE-2011-3440
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ipad2 | affected | apple | — | — |
| iphone_os | affected | apple | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.