Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
389 results · page 1 of 8
Oct 27, 2026A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL.CVE-2026-118178 · Computers, phones & browsers · Mozilla · reported by security@mozilla.org
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials. The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
- Product
- Thunderbird
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Oct 2, 2024A logic issue was addressed with improved restrictions.CVE-2024-44193 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved restrictions. This issue is fixed in iTunes 12.13.3 for Windows. A local attacker may be able to elevate their privileges.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2024The issue was addressed with improved checks.CVE-2024-27793 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
The issue was addressed with improved checks. This issue is fixed in iTunes 12.13.2 for Windows. Parsing a file may lead to an unexpected app termination or arbitrary code execution.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comseclists.org
Apr 26, 2024A logic issue was addressed with improved checks.CVE-2022-48611 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.claris.comsupport.apple.com
Mar 14, 2024A logic issue was addressed with improved checks.CVE-2023-42938 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker may be able to elevate their privileges.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 23, 2023A logic issue was addressed with improved checks.CVE-2023-32353 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to elevate privileges.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jun 23, 2023A logic issue was addressed with improved checks.CVE-2023-32351 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.9 for Windows. An app may be able to gain elevated privileges.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Sep 23, 2022An out-of-bounds read was addressed with improved input validation.CVE-2020-36521 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iCloud for Windows 11.4, iOS 14.0 and iPadOS 14.0, watchOS 7.0, tvOS 14.0, iCloud for Windows 7.21, iTunes for Windows 12.10.9. Processing a maliciously crafted tiff file may lead to a denial-of-service or potentially disclose memory contents.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 26, 2022A logic issue was addressed with improved state management.CVE-2022-26774 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
May 26, 2022A logic issue was addressed with improved state management.CVE-2022-26773 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for which it does not have permission.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 4, 2022iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility.CVE-2022-23611 · Other software · bildsben · reported by GitHubHigh 8.1
iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.
- Product
- iTunesRPC-Remastered
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 4, 2022iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility.CVE-2022-23609 · Other software · bildsben · reported by GitHubHigh 8.3
iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible.
- Product
- iTunesRPC-Remastered
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 1, 2022iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music.CVE-2022-23603 · Other software · Itunesrpc-remastered Project · reported by GitHubCritical 9.9
iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.
- Product
- Itunesrpc-remastered
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2021A validation issue was addressed with improved input sanitization.CVE-2021-30862 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.1
A validation issue was addressed with improved input sanitization. This issue is fixed in iTunes U 3.8.3. Processing a maliciously crafted URL may lead to arbitrary javascript code execution.
- Product
- iTunes U
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 8, 2020An information disclosure issue existed in the transition of program state.CVE-2020-27895 · Computers, phones & browsers · Apple · reported by product-security@apple.comLow 3.3
An information disclosure issue existed in the transition of program state. This issue was addressed with improved state handling. This issue is fixed in iTunes 12.11 for Windows. A malicious application may be able to access local users Apple IDs.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Feb 27, 2020The issue was addressed with improved permissions logic.CVE-2020-3861 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.1
The issue was addressed with improved permissions logic. This issue is fixed in iTunes for Windows 12.10.4. A user may gain access to protected parts of the file system.
- Product
- iTunes for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019A dynamic library loading issue existed in iTunes setup.CVE-2019-8801 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching. This issue is fixed in macOS Catalina 10.15.1, iTunes for Windows 12.10.2. Running the iTunes installer in an untrusted directory may result in arbitrary code execution.
- Product
- macOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Dec 18, 2019A race condition existed during the installation of iTunes for Windows.CVE-2019-6232 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.5
A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iTunes installer in an untrusted directory may result in arbitrary code execution.
- Product
- iCloud for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 11, 2019In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elemeCVE-2018-4278 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 4.3
In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsecurity.gentoo.org
Jan 11, 2019In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issuesCVE-2018-4262 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issues were addressed with improved memory handling.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecuritytracker.comsecurity.gentoo.org
Jan 11, 2019In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaCVE-2018-4213 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgsupport.apple.com
Jan 11, 2019In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaCVE-2018-4212 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgsupport.apple.com
Jan 11, 2019In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling CVE-2018-4210 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In iOS before 11.3, Safari before 11.1, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, an array indexing issue existed in the handling of a function in javascript core. This issue was addressed with improved checks.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgsupport.apple.com
Jan 11, 2019In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaCVE-2018-4209 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgsupport.apple.com
Jan 11, 2019In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaCVE-2018-4208 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgsupport.apple.com
Jan 11, 2019In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaCVE-2018-4207 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gentoo.orgsupport.apple.com
Jan 11, 2019In iOS before 11.4, iCloud for Windows before 7.5, watchOS before 4.3.1, iTunes before 12.7.5 for Windows, and macOS High Sierra before 10.13.5, an out-of-boundCVE-2018-4194 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
In iOS before 11.4, iCloud for Windows before 7.5, watchOS before 4.3.1, iTunes before 12.7.5 for Windows, and macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.
- Product
- Iphone OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Jan 11, 2019In iCloud for Windows before 7.3, Safari before 11.0.3, iTunes before 12.7.3 for Windows, and iOS before 11.2.5, multiple memory corruption issues exist and werCVE-2018-4147 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
In iCloud for Windows before 7.3, Safari before 11.0.3, iTunes before 12.7.3 for Windows, and iOS before 11.2.5, multiple memory corruption issues exist and were addressed with improved memory handling.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.apple.comsupport.apple.com
Oct 22, 2017An issue was discovered in certain Apple products.CVE-2017-7079 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An issue was discovered in certain Apple products. iTunes before 12.7 is affected. The issue involves the "Data Sync" component. It allows attackers to access iOS backups (written by iTunes) via a crafted app.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.apple.com
Jul 20, 2017An issue was discovered in certain Apple products.CVE-2017-7064 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 5.5
An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. The issue involves the "WebKit" component. It allows attackers to bypass intended memory-read restrictions via a crafted app.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Jul 20, 2017An issue was discovered in certain Apple products.CVE-2017-7053 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 7.8
An issue was discovered in certain Apple products. iTunes before 12.6.2 on Windows is affected. The issue involves the "iTunes" component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.apple.com
Feb 20, 2017An issue was discovered in certain Apple products.CVE-2016-7611 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Feb 20, 2017An issue was discovered in certain Apple products.CVE-2016-4764 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
An issue was discovered in certain Apple products. iOS before 10 is affected. Safari before 10 is affected. iTunes before 12.5.1 is affected. tvOS before 10 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsupport.apple.com
Sep 25, 2016WebKit in Apple iTunes before 12.5.1 on Windows and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corrCVE-2016-4769 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iTunes before 12.5.1 on Windows and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause CVE-2016-4768 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4767.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause CVE-2016-4767 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4766, and CVE-2016-4768.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause CVE-2016-4766 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4765, CVE-2016-4767, and CVE-2016-4768.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause CVE-2016-4765 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4759, CVE-2016-4766, CVE-2016-4767, and CVE-2016-4768.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS serversCVE-2016-4763 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.8
WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificates from HTTPS servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers to execute arbitrary CVE-2016-4762 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP SCVE-2016-4760 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attacks against non-HTTP Safari sessions by leveraging HTTP/0.9 support.
- Product
- Itunes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause CVE-2016-4759 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, and CVE-2016-4768.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows reCVE-2016-4758 · Computers, phones & browsers · Apple · reported by product-security@apple.comMedium 6.5
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Sep 25, 2016WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers CVE-2016-4728 · Computers, phones & browsers · Apple · reported by product-security@apple.comHigh 8.8
WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allows remote attackers to execute arbitrary code via a crafted web site.
- Product
- Safari
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Jul 21, 2016libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2CVE-2016-4616 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4614, CVE-2016-4615, and CVE-2016-4619.
- Product
- Iphone OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Jul 21, 2016libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2CVE-2016-4615 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4614, CVE-2016-4616, and CVE-2016-4619.
- Product
- Iphone OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Jul 21, 2016libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2CVE-2016-4614 · Computers, phones & browsers · Apple · reported by product-security@apple.comCritical 9.8
libxml2 in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4615, CVE-2016-4616, and CVE-2016-4619.
- Product
- Icloud
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Jul 21, 2016libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2CVE-2016-4610 · Other software · Xmlsoft · reported by product-security@apple.comCritical 9.8
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4609, and CVE-2016-4612.
- Product
- Libxslt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Jul 21, 2016libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2CVE-2016-4609 · Other software · Xmlsoft · reported by product-security@apple.comCritical 9.8
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4608, CVE-2016-4610, and CVE-2016-4612.
- Product
- Libxslt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Jul 21, 2016libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2CVE-2016-4608 · Other software · Xmlsoft · reported by product-security@apple.comCritical 9.8
libxslt in Apple iOS before 9.3.3, OS X before 10.11.6, iTunes before 12.4.2 on Windows, iCloud before 5.2.1 on Windows, tvOS before 9.2.2, and watchOS before 2.2.2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2016-4607, CVE-2016-4609, CVE-2016-4610, and CVE-2016-4612.
- Product
- Libxslt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apple.comlists.apple.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.