Search Results (Refine Search)

Search Parameters:
  • CPE Product Version: cpe:/o:apple:iphone_os:1.0.2
There are 2,207 matching records.
Displaying matches 1,841 through 1,860.
Vuln ID Summary CVSS Severity
CVE-2013-5159

WebKit in Apple iOS before 7 allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive information about use of the window.webkitRequestAnimationFrame API via an IFRAME element.

Published: September 19, 2013; 6:28:01 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-5158

The Social subsystem in Apple iOS before 7 does not properly restrict access to the cache of Twitter icons, which allows physically proximate attackers to obtain sensitive information about recent Twitter interaction via unspecified vectors.

Published: September 19, 2013; 6:28:01 AM -0400
V3.x:(not available)
V2.0: 2.1 LOW
CVE-2013-5157

The Twitter subsystem in Apple iOS before 7 does not require API conformity for access to Twitter daemon interfaces, which allows attackers to post Tweets via a crafted app that sends direct requests to the daemon.

Published: September 19, 2013; 6:28:01 AM -0400
V3.x:(not available)
V2.0: 5.0 MEDIUM
CVE-2013-5156

The Telephony subsystem in Apple iOS before 7 does not require API conformity for access to telephony-daemon interfaces, which allows attackers to bypass intended restrictions on phone calls via a crafted app that sends direct requests to the daemon.

Published: September 19, 2013; 6:28:01 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-5155

The Sandbox subsystem in Apple iOS before 7 allows attackers to cause a denial of service (infinite loop) via an application that writes crafted values to /dev/random.

Published: September 19, 2013; 6:28:01 AM -0400
V3.x:(not available)
V2.0: 7.1 HIGH
CVE-2013-5154

The Sandbox subsystem in Apple iOS before 7 determines the sandboxing requirement for a #! application on the basis of the script interpreter instead of the script, which allows attackers to bypass intended access restrictions via a crafted application.

Published: September 19, 2013; 6:28:01 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-5153

Springboard in Apple iOS before 7 does not properly manage the lock state in Lost Mode, which allows physically proximate attackers to read notifications via unspecified vectors.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 2.1 LOW
CVE-2013-5152

Mobile Safari in Apple iOS before 7 allows remote attackers to spoof the URL bar via a crafted web site.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-5151

Mobile Safari in Apple iOS before 7 does not prevent HTML interpretation of a document served with a text/plain content type, which allows remote attackers to conduct cross-site scripting (XSS) attacks by uploading a file.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-5150

The history-clearing feature in Safari in Apple iOS before 7 does not clear the back/forward history of an open tab, which allows physically proximate attackers to obtain sensitive information by leveraging an unattended workstation.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 1.9 LOW
CVE-2013-5149

The Push Notifications subsystem in Apple iOS before 7 provides the push-notification token to an app without user approval, which allows attackers to obtain sensitive information via an app that employs a crafted push-notification registration process.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM
CVE-2013-5147

Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 3.7 LOW
CVE-2013-5145

kextd in Kext Management in Apple iOS before 7 does not properly verify authorization for IPC messages, which allows local users to (1) load or (2) unload kernel extensions via a crafted message.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 6.3 MEDIUM
CVE-2013-5142

The kernel in Apple iOS before 7 does not initialize unspecified kernel data structures, which allows local users to obtain sensitive information from kernel stack memory via the (1) msgctl API or (2) segctl API.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 4.9 MEDIUM
CVE-2013-5141

The kernel in Apple iOS before 7 uses an incorrect data size for a certain integer variable, which allows attackers to cause a denial of service (infinite loop and device hang) via a crafted application, related to an "integer truncation vulnerability."

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 7.1 HIGH
CVE-2013-5140

The kernel in Apple iOS before 7 allows remote attackers to cause a denial of service (assertion failure and device restart) via an invalid packet fragment.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 7.8 HIGH
CVE-2013-5139

The IOSerialFamily driver in Apple iOS before 7 allows attackers to execute arbitrary code or cause a denial of service (out-of-bounds array access) via a crafted application.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 9.3 HIGH
CVE-2013-5138

IOCatalogue in IOKitUser in Apple iOS before 7 allows attackers to cause a denial of service (NULL pointer dereference and device crash) via a crafted application.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 4.7 MEDIUM
CVE-2013-5137

IOKit in Apple iOS before 7 allows attackers to send user-interface events to the foreground app by leveraging control over a background app and using the (1) task-completion API or (2) VoIP API.

Published: September 19, 2013; 6:28:00 AM -0400
V3.x:(not available)
V2.0: 2.6 LOW
CVE-2013-5131

Cross-site scripting (XSS) vulnerability in WebKit in Apple iOS before 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Published: September 19, 2013; 6:27:56 AM -0400
V3.x:(not available)
V2.0: 4.3 MEDIUM