Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).
The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
CVEs:CVE-2014-3566
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x | affected | apple | — | — |
The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a Client...
CVEs:CVE-2015-4000
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
| mac_os_x | affected | apple | — | — |
| safari | affected | apple | — | — |
The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URL...
CVEs:CVE-2012-3489
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| mac_os_x_server | affected | apple | — | — |
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified...
CVEs:CVE-2012-2870
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unkn...
CVEs:CVE-2012-2871
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
Apple Remote Desktop before 3.6.1 does not recognize the "Encrypt all network data" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network.
CVEs:CVE-2012-0681
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| apple_remote_desktop | affected | apple | — | — |
Use-after-free vulnerability in the Cascading Style Sheets (CSS) DOM implementation in Google Chrome before 21.0.1180.57 on Mac OS X and Linux, and before 21.0.1180.60 on Windows and Chrome Frame, allows remote attackers to cause a denial of service or...
CVEs:CVE-2012-2857
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| iphone_os | affected | apple | — | — |
Apple iChat Server does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via responses for domains that were not asserted.
CVEs:CVE-2012-4672
| Product | Status | Vendor | Package | Ecosystem |
|---|---|---|---|---|
| ichat_server | affected | apple | — | — |
Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.