CVE Vulnerability Advisory Database

[Affected Scope] Apple operating systems prior to iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2, and tvOS 16.2

[Impact] A local attacker with arbitrary read and write capabilities can bypass Pointer Authentication (PAC) to achieve full kernel-level code execution

[Mitigation] Immediately update affected devices to iOS 16.2, iPadOS 16.2, macOS Ventura 13.1, or later versions

[Affected Scope] iPhone and iPad devices running iOS 16.6 and prior

[Impact] A local attacker can bypass sandbox restrictions to elevate privileges to kernel level, leading to complete device compromise

[Mitigation] Immediately update affected devices to iOS 16.7.1 / iPadOS 16.7.1 or later

[Affected Scope] Cisco IOS and Cisco IOS XE Software with the Group Encrypted Transport VPN (GET VPN) feature enabled

[Impact] An authenticated, remote attacker with administrative control over a key server or group member can execute arbitrary code or cause a device reload (DoS)

[Mitigation] Apply the official Cisco software updates and restrict GDOI/G-IKEv2 protocol access to authorized infrastructure nodes only

[Affected Scope] Apple WebKit-based browsers and applications on iOS versions prior to 16.7 and macOS prior to Sonoma 14

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution on the target system

[Mitigation] Immediately update Apple operating systems to the latest versions (iOS 16.7+ / macOS Sonoma 14+)

[Affected Scope] Apple iOS devices prior to 16.7, iPadOS prior to 16.7, macOS Monterey prior to 12.7, and macOS Ventura prior to 13.6

[Impact] A local attacker can bypass security boundaries to elevate privileges to kernel level, enabling arbitrary code execution and full device compromise; actively exploited in the wild

[Mitigation] Immediately apply the official security updates to iOS/iPadOS 16.7, macOS Monterey 12.7, macOS Ventura 13.6, or later versions

[Affected Scope] Apple devices running iOS versions prior to 16.7, iPadOS versions prior to 16.7, and macOS Ventura versions prior to 13.6

[Impact] A malicious application can bypass signature and certificate validation, allowing it to execute with elevated privileges and compromise the system. This has been actively exploited in the wild

[Mitigation] Immediately update all affected devices to iOS/iPadOS 16.7 or later, and macOS Ventura 13.6 or later

[Affected Scope] Apple iOS/iPadOS prior to 15.7.8 and 16.3, macOS Monterey prior to 12.6.8, macOS Big Sur prior to 11.7.9, macOS Ventura prior to 13.2, tvOS prior to 16.3, and watchOS prior to 9.3

[Impact] Processing a maliciously crafted font file may lead to arbitrary code execution (RCE) with system privileges, and active exploitation in the wild has been reported

[Mitigation] Immediately update all affected Apple devices to the latest patched OS versions (iOS 15.7.8 / 16.3, macOS 12.6.8 / 11.7.9 / 13.2 or later)

[Affected Scope] Apple iOS and iPadOS prior to 16.6.1, macOS Monterey prior to 12.6.9, macOS Ventura prior to 13.5.2, iOS/iPadOS prior to 15.7.9, and macOS Big Sur prior to 11.7.10

[Impact] Processing a maliciously crafted image can trigger a buffer overflow, leading to arbitrary code execution (RCE) and potential system takeover

[Mitigation] Immediately apply the official security updates (iOS 16.6.1, macOS 13.5.2, etc.) and consider enabling Lockdown Mode for high-risk environments

[Affected Scope] Apple iOS devices prior to 16.6.1, iPadOS devices prior to 16.6.1, and watchOS devices prior to 9.6.2

[Impact] A maliciously crafted attachment can bypass validation logic, allowing attackers to execute arbitrary code with system privileges without user interaction

[Mitigation] Immediately update affected devices to iOS 16.6.1, iPadOS 16.6.1, watchOS 9.6.2, or later versions

[Affected Scope] Apple iOS/iPadOS prior to 15.6, macOS Monterey prior to 12.5, Safari prior to 15.6, watchOS prior to 8.7, and tvOS prior to 15.6

[Impact] Processing maliciously crafted web content may allow remote attackers to execute arbitrary code on the target system

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to patched versions

[Affected Scope] Apple iOS and iPadOS prior to 15.7.8 / 16.6, macOS Big Sur prior to 11.7.9, macOS Monterey prior to 12.6.8, macOS Ventura prior to 13.5, tvOS prior to 16.6, and watchOS prior to 9.6

[Impact] A local application can bypass kernel memory protections and modify sensitive kernel states, leading to complete system compromise and arbitrary code execution

[Mitigation] Immediately apply the official security updates provided by Apple (iOS 15.7.8 / 16.6, macOS 13.5, etc.) and enforce updates via MDM

[Affected Scope] Apple iOS before 16.6, iPadOS before 16.6, macOS Ventura before 13.5, Safari before 16.5.2, tvOS before 16.6, and watchOS before 9.6

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) within the sandbox context, and this vulnerability has been actively exploited in the wild

[Mitigation] Immediately apply the official software updates provided by Apple to patch the operating systems and Safari browser

[Affected Scope] iOS versions prior to 15.7.7 and 16.4, iPadOS prior to 15.7.7 and 16.4, macOS Ventura prior to 13.3, and Safari prior to 16.4

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution and complete system compromise

[Mitigation] Immediately apply official Apple software updates to secure versions (iOS 15.7.7/16.4, macOS Ventura 13.3, etc.)

[Affected Scope] Systems running iOS/iPadOS prior to 15.7.7 and 16.5.1, macOS Big Sur/Monterey/Ventura prior to specific patched releases, and watchOS prior to 8.8.1 and 9.5.2

[Impact] A local application can exploit this vulnerability to execute arbitrary code with kernel privileges, leading to complete system compromise. Active exploitation has been reported in the wild

[Mitigation] Immediately apply the official security updates provided by Apple (e.g., iOS 16.5.1, macOS 13.4.1)

[Affected Scope] iOS/iPadOS 15 and 16, macOS Ventura, watchOS, tvOS, and Safari versions prior to 16.5

[Impact] A remote attacker can bypass the Web Content sandbox and potentially execute arbitrary code on the host system due to a bounds check validation flaw, which is actively exploited in the wild

[Mitigation] Immediately apply the official security updates provided by Apple (iOS 16.5, macOS 13.4, Safari 16.5, etc.)

[Affected Scope] iOS/iPadOS 15 and 16, macOS Ventura, watchOS, tvOS, and Safari versions prior to 16.5

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE), and Apple is aware of active exploitation in the wild

[Mitigation] Immediately update operating systems and Safari to the latest patched versions using Apple's official software update mechanism

[Affected Scope] All Apple devices running versions prior to iOS/iPadOS 15.7.6 and 16.5, macOS Ventura 13.4, tvOS 16.5, watchOS 9.5, and Safari 16.5

[Impact] Processing maliciously crafted web content may lead to out-of-bounds memory access, disclosing sensitive system information and enabling further sandbox escape or privilege escalation

[Mitigation] Immediately apply official Apple software updates to upgrade to iOS 16.5, macOS Ventura 13.4, Safari 16.5, or later

[Affected Scope] iOS/iPadOS before 15.2, macOS Monterey before 12.1, Safari before 15.2, tvOS before 15.2, watchOS before 8.3

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution on the target system.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to the patched versions.

[Affected Scope] Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX before 7.0

[Impact] Unauthenticated remote attackers can retrieve sensitive information from device memory (including private keys and configuration data) by sending crafted IKEv1 negotiation requests

[Mitigation] Upgrade affected device firmware to the latest patched releases, or restrict access to UDP ports 500 and 4500 using infrastructure ACLs to trusted peers only

[Affected Scope] Cisco 871 Integrated Services Routers (ISR) running Cisco IOS 12.4 with the HTTP Administration component enabled.

[Impact] Remote attackers can execute arbitrary commands with privilege level 15 by tricking an authenticated administrator into visiting a malicious link, leading to complete device compromise.

[Mitigation] Disable the HTTP/HTTPS server on the router, restrict access using IP-based Access Control Lists (ACLs), or upgrade to a patched Cisco IOS release.