Filtered by vendor Apple Subscriptions
Filtered by product Xcode Subscriptions

Search

Switch to Advanced Search (Beta)
Total 86 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-1765 1 Apple 1 Xcode 2025-04-12 N/A
otool in Apple Xcode before 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors.
CVE-2016-4704 1 Apple 1 Xcode 2025-04-12 N/A
otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4705.
CVE-2016-4705 1 Apple 1 Xcode 2025-04-12 N/A
otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4704.
CVE-2015-3187 3 Apache, Apple, Redhat 3 Subversion, Xcode, Enterprise Linux 2025-04-12 N/A
The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path.
CVE-2015-5909 1 Apple 1 Xcode 2025-04-12 N/A
IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery.
CVE-2012-3698 1 Apple 1 Xcode 2025-04-11 N/A
Apple Xcode before 4.4 does not properly compose a designated requirement (DR) during signing of programs that lack bundle identifiers, which allows remote attackers to read keychain entries via a crafted app, as demonstrated by the keychain entries of a (1) helper tool or (2) command-line tool.
CVE-2006-5327 2 Apple, Openbase International Ltd 2 Xcode, Openbase 2025-04-09 N/A
Untrusted search path vulnerability in OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to execute arbitrary code via a modified PATH that references a malicious gzip program, which is executed by gnutar with certain TAR_OPTIONS environment variable settings, when gnutar is invoked by OpenBase.
CVE-2008-2318 1 Apple 2 Xcode, Xcode Tools 2025-04-09 N/A
The WOHyperlink implementation in WebObjects in Apple Xcode tools before 3.1 appends local session IDs to generated non-local URLs, which allows remote attackers to obtain potentially sensitive information by reading the requests for these URLs.
CVE-2006-5328 2 Apple, Openbase International Ltd 2 Xcode, Openbase 2025-04-09 N/A
OpenBase SQL 10.0 and earlier, as used in Apple Xcode 2.2 2.2 and earlier and possibly other products, allows local users to create arbitrary files via a symlink attack on the simulation.sql file.
CVE-2025-30441 1 Apple 1 Xcode 2025-04-04 5.5 Medium
This issue was addressed through improved state management. This issue is fixed in Xcode 16.3. An app may be able to overwrite arbitrary files.
CVE-2025-24226 1 Apple 1 Xcode 2025-04-04 5.5 Medium
The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.
CVE-2021-44228 13 Apache, Apple, Bentley and 10 more 178 Log4j, Xcode, Synchro and 175 more 2025-04-03 10 Critical
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2004-2687 2 Apple, Samba 2 Xcode, Samba 2025-04-03 N/A
distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to the server port, allows remote attackers to execute arbitrary commands via compilation jobs, which are executed by the server without authorization checks.
CVE-2006-1466 1 Apple 2 Mac Os X, Xcode 2025-04-03 N/A
Xcode Tools before 2.3 for Mac OS X 10.4, when running the WebObjects plugin, allows remote attackers to access or modify WebObjects projects through a network service.
CVE-2024-44191 1 Apple 7 Ipados, Iphone Os, Macos and 4 more 2025-03-25 5.5 Medium
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, Xcode 16, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. An app may gain unauthorized access to Bluetooth.
CVE-2024-44162 1 Apple 1 Xcode 2025-03-19 7.8 High
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 16. A malicious application may gain access to a user's Keychain items.
CVE-2024-44228 1 Apple 1 Xcode 2025-03-13 7.5 High
This issue was addressed with improved permissions checking. This issue is fixed in Xcode 16. An app may be able to inherit Xcode permissions and access user data.
CVE-2022-42797 1 Apple 1 Xcode 2025-03-11 7.8 High
An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileges.
CVE-2023-40435 1 Apple 1 Xcode 2025-02-13 5.5 Medium
This issue was addressed by enabling hardened runtime. This issue is fixed in Xcode 15. An app may be able to access App Store credentials.
CVE-2023-40391 1 Apple 5 Ipados, Iphone Os, Macos and 2 more 2025-02-13 5.5 Medium
The issue was addressed with improved memory handling. This issue is fixed in tvOS 17, iOS 17 and iPadOS 17, macOS Sonoma 14, Xcode 15. An app may be able to disclose kernel memory.