Search Results (Refine Search)
- CPE Product Version: cpe:/o:apple:iphone_os:3.2:-:iphone
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2012-0674 |
Safari in Apple iOS before 5.1.1 allows remote attackers to spoof the location bar's URL via a crafted web site. Published: May 08, 2012; 6:25:47 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2012-0672 |
WebKit in Apple iOS before 5.1.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Published: May 08, 2012; 6:25:46 AM -0400 |
V3.x:(not available) V2.0: 6.8 MEDIUM |
CVE-2011-3441 |
libinfo in Apple iOS before 5.0.1 does not properly formulate domain-name queries, which allows remote attackers to obtain sensitive information via a crafted DNS hostname. Published: November 11, 2011; 1:55:01 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2011-3434 |
The WiFi component in Apple iOS before 5 stores WiFi credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application. Published: October 14, 2011; 6:55:11 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2011-3432 |
The UIKit Alerts component in Apple iOS before 5 allows remote attackers to cause a denial of service (device hang) via a long tel: URL that triggers a large size for the acceptance dialog. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2011-3431 |
The Home screen component in Apple iOS before 5 does not properly support a certain application-switching gesture, which might allow physically proximate attackers to obtain sensitive state information by watching the device's screen. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2011-3430 |
The Settings component in Apple iOS before 5, when a configuration profile is used for a locale other than English, does not properly implement localization, which makes it easier for attackers to have an unspecified impact by leveraging incorrect configuration display. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 9.3 HIGH |
CVE-2011-3429 |
The Settings component in Apple iOS before 5 stores a cleartext parental-restrictions passcode in an unspecified file, which might allow physically proximate attackers to obtain sensitive information by reading this file. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2011-3427 |
The Data Security component in Apple iOS before 5 and Apple TV before 4.4 does not properly restrict use of the MD5 hash algorithm within X.509 certificates, which makes it easier for man-in-the-middle attackers to spoof servers or obtain sensitive information via a crafted certificate. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 2.6 LOW |
CVE-2011-3426 |
Cross-site scripting (XSS) vulnerability in Safari in Apple iOS before 5 allows remote web servers to inject arbitrary web script or HTML via a file accompanied by a "Content-Disposition: attachment" HTTP header. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2011-3261 |
Double free vulnerability in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Excel spreadsheet. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 6.8 MEDIUM |
CVE-2011-3260 |
Buffer overflow in OfficeImport in Apple iOS before 5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Word document. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 6.8 MEDIUM |
CVE-2011-3259 |
The kernel in Apple iOS before 5 and Apple TV before 4.4 does not properly recover memory allocated for incomplete TCP connections, which allows remote attackers to cause a denial of service (resource consumption) by making many connection attempts. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2011-3257 |
The Data Access component in Apple iOS before 5 does not properly handle the existence of multiple user accounts on the same mail server, which allows local users to bypass intended access restrictions in opportunistic circumstances by leveraging a different account's cookie. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2011-3256 |
FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226. Published: October 14, 2011; 6:55:10 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2011-3255 |
CFNetwork in Apple iOS before 5 stores AppleID credentials in an unspecified file, which makes it easier for remote attackers to obtain sensitive information via a crafted application. Published: October 14, 2011; 6:55:09 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2011-3253 |
CalDAV in Apple iOS before 5 does not validate X.509 certificates for SSL sessions, which allows man-in-the-middle attackers to spoof calendar servers and obtain sensitive information via an arbitrary certificate. Published: October 14, 2011; 6:55:09 AM -0400 |
V3.x:(not available) V2.0: 2.6 LOW |
CVE-2011-3246 |
CFNetwork in Apple iOS before 5.0.1 and Mac OS X 10.7 before 10.7.2 does not properly parse URLs, which allows remote attackers to trigger visits to unintended web sites, and transmission of cookies to unintended web sites, via a crafted (1) http or (2) https URL. Published: October 14, 2011; 6:55:09 AM -0400 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2011-3245 |
The Keyboards component in Apple iOS before 5 displays the final character of an entered password during a subsequent use of a keyboard, which allows physically proximate attackers to obtain sensitive information by reading this character. Published: October 14, 2011; 6:55:09 AM -0400 |
V3.x:(not available) V2.0: 2.1 LOW |
CVE-2011-3243 |
Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5 and Safari before 5.1.1, allows remote attackers to inject arbitrary web script or HTML via vectors involving inactive DOM windows. Published: October 14, 2011; 6:55:09 AM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |