IT
Product
Itunes
On CISA KEVExploited in the wild
922
CVEs
2
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 22High 363Medium 87Low 3
Watch
Add Itunes to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11760 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 12.10.8 |
| CVE-2020-11759 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 12.10.8 |
| CVE-2020-11758 | 5.5 | Apr 14 | An issue was discovered in OpenEXR before 2.4.1 Affected: before 12.10.8 |
| CVE-2019-8598 | 5.5 | Dec 18 | An input validation issue was addressed with improved input validation Affected: before 12.9.5 |
| CVE-2018-4226 | 5.5 | Jun 8 | An issue was discovered in certain Apple products Affected: before 12.7.5 |
| CVE-2018-4225 | 5.5 | Jun 8 | An issue was discovered in certain Apple products Affected: before 12.7.5 |
| CVE-2018-4224 | 5.5 | Jun 8 | An issue was discovered in certain Apple products Affected: before 12.7.5 |
| CVE-2017-7079 | 5.5 | Oct 23 | An issue was discovered in certain Apple products Affected: through 12.6.2 |
| CVE-2017-7064 | 5.5 | Jul 20 | An issue was discovered in certain Apple products Affected: through 12.6.1 |
| CVE-2020-9916 | 5.3 | Oct 16 | A URL Unicode encoding issue was addressed with improved state management Affected: before 12.10.8 |
| CVE-2019-13118 | 5.3 | Jul 1 | In numbers.c in libxslt 1.1.33, a type holding grouping characters of an xsl:number instruction was too narrow and an invalid character/length combination could be passed to… Affected: before 12.9.6 |
| CVE-2018-4293 | 5.3 | Apr 3 | A cookie management issue was addressed with improved checks Affected: before 12.8 |
| CVE-2019-8898 | 4.3 | Oct 27 | An information disclosure issue existed in the handling of the Storage Access API Affected: before 12.10.3 |
| CVE-2019-8834 | 4.3 | Oct 27 | A configuration issue was addressed with additional restrictions Affected: before 12.10.3 |
| CVE-2019-8827 | 4.3 | Oct 27 | The HTTP referrer header may be used to leak browsing history Affected: before 12.10.2 |
| CVE-2020-9894 | 4.3 | Oct 16 | An out-of-bounds read was addressed with improved input validation Affected: before 12.10.8 |
| CVE-2020-3887 | 4.3 | Apr 1 | A logic issue was addressed with improved restrictions Affected: before 12.10.5 |
| CVE-2020-3885 | 4.3 | Apr 1 | A logic issue was addressed with improved restrictions Affected: before 12.10.5 |
| CVE-2018-4440 | 4.3 | Apr 3 | A logic issue was addressed with improved state management Affected: before 12.9.2 |
| CVE-2018-4278 | 4.3 | Jan 11 | In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be… Affected: before 12.8 |
| CVE-2018-4232 | 4.3 | Jun 8 | An issue was discovered in certain Apple products Affected: before 12.7.5 |
| CVE-2016-7592 | 4.3 | Feb 20 | An issue was discovered in certain Apple products Affected: through 12.5.3 |
| CVE-2020-27895 | 3.3 | Dec 8 | An information disclosure issue existed in the transition of program state Affected: before 12.11 |
| CVE-2020-3894 | 3.1 | Apr 1 | A race condition was addressed with additional validation Affected: before 12.10.5 |
| CVE-2017-2383 | 3.1 | Apr 2 | An issue was discovered in certain Apple products Affected: through 12.5.5.5 |
| CVE-2015-7014 | – | Oct 23 | WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: through 12.3.0 |
| CVE-2015-7013 | – | Oct 23 | WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and… Affected: through 12.3.0 |
| CVE-2015-7012 | – | Oct 23 | WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: through 12.3.0 |
| CVE-2015-7011 | – | Oct 23 | WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and… Affected: through 12.3.0 |
| CVE-2015-7002 | – | Oct 23 | WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: through 12.3.0 |
| CVE-2015-5931 | – | Oct 23 | WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and… Affected: through 12.3.0 |
| CVE-2015-5930 | – | Oct 23 | WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: through 12.3.0 |
| CVE-2015-5929 | – | Oct 23 | WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: through 12.3.0 |
| CVE-2015-5928 | – | Oct 23 | WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory… Affected: through 12.3.0 |
| CVE-2015-7017 | – | Oct 23 | CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… Affected: through 12.3.0 |
| CVE-2015-6992 | – | Oct 23 | CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… Affected: through 12.3.0 |
| CVE-2015-6975 | – | Oct 23 | CoreText in Apple iOS before 9.1, OS X before 10.11.1, and iTunes before 12.3.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… Affected: through 12.3.0 |
| CVE-2015-5920 | – | Sep 18 | The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers to discover encrypted SMB credentials via… Affected: through 12.2 |
| CVE-2015-5874 | – | Sep 18 | CoreText in Apple iOS before 9 and iTunes before 12.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file Affected: through 12.2 |
| CVE-2015-5823 | – | Sep 18 | WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption… Affected: through 12.2 |
| CVE-2015-5822 | – | Sep 18 | WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption… Affected: through 12.2 |
| CVE-2015-5821 | – | Sep 18 | WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application… Affected: through 12.2 |
| CVE-2015-5819 | – | Sep 18 | WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application… Affected: through 12.2 |
| CVE-2015-5818 | – | Sep 18 | WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application… Affected: through 12.2 |
| CVE-2015-5817 | – | Sep 18 | WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application… Affected: through 12.2 |
| CVE-2015-5816 | – | Sep 18 | WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption… Affected: through 12.2 |
| CVE-2015-5815 | – | Sep 18 | WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash)… Affected: through 12.2 |
| CVE-2015-5814 | – | Sep 18 | WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption… Affected: through 12.2 |
| CVE-2015-5813 | – | Sep 18 | WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application… Affected: through 12.2 |
| CVE-2015-5812 | – | Sep 18 | WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application… Affected: through 12.2 |
The 500 most important CVEs for this product (exploited first, then by severity)