National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

Search Results (Refine Search)

Search Parameters:
  • Contains Software Flaws (CVE)
  • CPE Product Version: cpe:/o:apple:iphone_os:4.2.1
There are 1,792 matching records.
Displaying matches 1761 through 1780.
Vuln ID Summary CVSS Severity
CVE-2011-2868

WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.

Published: March 08, 2012; 05:55:01 PM -05:00
    V2: 9.3 HIGH
CVE-2011-2867

WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.

Published: March 08, 2012; 05:55:01 PM -05:00
    V2: 9.3 HIGH
CVE-2011-2833

WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.

Published: March 08, 2012; 05:55:01 PM -05:00
    V2: 9.3 HIGH
CVE-2011-3441

libinfo in Apple iOS before 5.0.1 does not properly formulate domain-name queries, which allows remote attackers to obtain sensitive information via a crafted DNS hostname.

Published: November 11, 2011; 01:55:01 PM -05:00
    V2: 4.3 MEDIUM
CVE-2011-3440

The Passcode Lock feature in Apple iOS before 5.0.1 on the iPad 2 does not properly implement the locked state, which allows physically proximate attackers to access data by opening a Smart Cover during power-off confirmation.

Published: November 11, 2011; 01:55:01 PM -05:00
    V2: 1.2 LOW
CVE-2011-3439

FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document.

Published: November 11, 2011; 01:55:01 PM -05:00
    V2: 9.3 HIGH
CVE-2011-3434

The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application.

Published: October 14, 2011; 06:55:11 AM -04:00
    V2: 4.3 MEDIUM
CVE-2011-3432

The UIKit Alerts component in Apple iOS before 5 allows remote attackers to cause a denial of service (device hang) via a long tel: URL that triggers a large size for the acceptance dialog.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 5.0 MEDIUM
CVE-2011-3431

The Home screen component in Apple iOS before 5 does not properly support a certain application-switching gesture, which might allow physically proximate attackers to obtain sensitive state information by watching the device's screen.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 2.1 LOW
CVE-2011-3430

The Settings component in Apple iOS before 5, when a configuration profile is used for a locale other than English, does not properly implement localization, which makes it easier for attackers to have an unspecified impact by leveraging incorrect configuration display.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 9.3 HIGH
CVE-2011-3429

The Settings component in Apple iOS before 5 stores a cleartext parental-restrictions passcode in an unspecified file, which might allow physically proximate attackers to obtain sensitive information by reading this file.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 2.1 LOW
CVE-2011-3427

The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 2.6 LOW
CVE-2011-3426

Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 4.3 MEDIUM
CVE-2011-3261

Double free vulnerability in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Excel spreadsheet.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 6.8 MEDIUM
CVE-2011-3260

Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word document.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 6.8 MEDIUM
CVE-2011-3259

The kernel in Apple iOS before 5 and Apple TV before 4.4 does not properly recover memory allocated for incomplete TCP connections, which allows remote attackers to cause a denial of service (resource consumption) by making many connection attempts.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 5.0 MEDIUM
CVE-2011-3257

The Data Access component in Apple iOS before 5 does not properly handle the existence of multiple user accounts on the same mail server, which allows local users to bypass intended access restrictions in opportunistic circumstances by leveraging a different account's cookie.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 2.1 LOW
CVE-2011-3256

FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226.

Published: October 14, 2011; 06:55:10 AM -04:00
    V2: 4.3 MEDIUM
CVE-2011-3255

CFNetwork in Apple iOS before 5 stores AppleID credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application.

Published: October 14, 2011; 06:55:09 AM -04:00
    V2: 4.3 MEDIUM
CVE-2011-3254

Cross-site scripting (XSS) vulnerability in Calendar in Apple iOS before 5 allows remote attackers to inject arbitrary web script or HTML via an invitation note.

Published: October 14, 2011; 06:55:09 AM -04:00
    V2: 4.3 MEDIUM