ByteOS

Product:Multiple Products

Added At:03 Nov, 2021

Due At:03 May, 2022

Apple Multiple Products Type Confusion Vulnerability

Apple iOS, iPadOS, macOS, and watchOS contain a type confusion vulnerability that may allow a malicious application to execute code with kernel privileges.

Used in Ransomware

Unknown

CWE

CWE-843

Required Action:

Apply updates per vendor instructions.

Additional Notes:

https://nvd.nist.gov/vuln/detail/CVE-2020-27932

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:apple

Assigner Org ID:286789f9-fbc2-4510-9f9a-43facdede74c

Published At:08 Dec, 2020 | 20:13

Updated At:30 Jul, 2025 | 01:45

▼CVE Numbering Authority (CNA)

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges.

From unspecified before 10.15 (custom)

Problem Types

Type	CWE ID	Description
text	N/A	A malicious application may be able to execute arbitrary code with kernel privileges..

Type: text

CWE ID: N/A

Description: A malicious application may be able to execute arbitrary code with kernel privileges..

References

Hyperlink	Resource
https://support.apple.com/en-us/HT211931	x_refsource_MISC
https://support.apple.com/en-us/HT211928	x_refsource_MISC
https://support.apple.com/en-us/HT211929	x_refsource_MISC
https://support.apple.com/en-us/HT211940	x_refsource_MISC
https://support.apple.com/en-us/HT211944	x_refsource_MISC
https://support.apple.com/en-us/HT211945	x_refsource_MISC
https://support.apple.com/en-us/HT211946	x_refsource_MISC
https://support.apple.com/en-us/HT211947	x_refsource_MISC
http://seclists.org/fulldisclosure/2020/Dec/32	mailing-list x_refsource_FULLDISC
http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html	x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211931

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211928

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211929

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211940

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211944

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211945

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211946

Resource:

x_refsource_MISC

Hyperlink: https://support.apple.com/en-us/HT211947

Resource:

x_refsource_MISC

Hyperlink: http://seclists.org/fulldisclosure/2020/Dec/32

Resource:

mailing-list

x_refsource_FULLDISC

Hyperlink: http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://support.apple.com/en-us/HT211931	x_refsource_MISC x_transferred
https://support.apple.com/en-us/HT211928	x_refsource_MISC x_transferred
https://support.apple.com/en-us/HT211929	x_refsource_MISC x_transferred
https://support.apple.com/en-us/HT211940	x_refsource_MISC x_transferred
https://support.apple.com/en-us/HT211944	x_refsource_MISC x_transferred
https://support.apple.com/en-us/HT211945	x_refsource_MISC x_transferred
https://support.apple.com/en-us/HT211946	x_refsource_MISC x_transferred
https://support.apple.com/en-us/HT211947	x_refsource_MISC x_transferred
http://seclists.org/fulldisclosure/2020/Dec/32	mailing-list x_refsource_FULLDISC x_transferred
http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html	x_refsource_MISC x_transferred

Hyperlink: https://support.apple.com/en-us/HT211931

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/en-us/HT211928

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/en-us/HT211929

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/en-us/HT211940

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/en-us/HT211944

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/en-us/HT211945

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/en-us/HT211946

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://support.apple.com/en-us/HT211947

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://seclists.org/fulldisclosure/2020/Dec/32

Resource:

mailing-list

x_refsource_FULLDISC

x_transferred

Hyperlink: http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html

Resource:

x_refsource_MISC

x_transferred

2. CISA ADP Vulnrichment

Problem Types

Type	CWE ID	Description
CWE	CWE-843	CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Type: CWE

CWE ID: CWE-843

Description: CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Metrics

Version	Base score	Base severity	Vector
3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Metrics Other Info

kev

dateAdded:

2021-11-03

reference:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-27932

Timeline

Event	Date
CVE-2020-27932 added to CISA KEV	2021-11-03 00:00:00

Event: CVE-2020-27932 added to CISA KEV

Date: 2021-11-03 00:00:00

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:product-security@apple.com

Published At:08 Dec, 2020 | 21:15

Updated At:02 Apr, 2025 | 19:09

CISA Catalog

Date Added	Due Date	Vulnerability Name	Required Action
2021-11-03	2022-05-03	Apple Multiple Products Type Confusion Vulnerability	Apply updates per vendor instructions.

Date Added: 2021-11-03

Due Date: 2022-05-03

Vulnerability Name: Apple Multiple Products Type Confusion Vulnerability

Required Action: Apply updates per vendor instructions.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Secondary	3.1	7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*

>>icloud>>Versions before 11.5(exclusive)

cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*

>>itunes>>Versions before 12.11(exclusive)

cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:*

>>ipados>>Versions before 14.2(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions before 12.4.9(exclusive)

cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

>>iphone_os>>Versions from 14.0(inclusive) to 14.2(exclusive)

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

>>mac_os_x>>Versions before 10.15.7(exclusive)

cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

>>macos>>Versions from 11.0(inclusive) to 11.0.1(exclusive)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

>>watchos>>Versions before 5.3.9(exclusive)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

>>watchos>>Versions from 6.0(inclusive) to 6.2.9(exclusive)

cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*

>>watchos>>Versions from 7.0(inclusive) to 7.1(exclusive)

Weaknesses

CWE ID	Type	Source
CWE-843	Primary	nvd@nist.gov
CWE-843	Secondary	134c704f-9b21-4f2e-91b3-4a467353bcc0

CWE ID: CWE-843

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-843

Type: Secondary

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

References

Hyperlink	Source	Resource
http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html	product-security@apple.com	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/32	product-security@apple.com	Mailing List Third Party Advisory
https://support.apple.com/en-us/HT211928	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT211929	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT211931	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT211940	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT211944	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT211945	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT211946	product-security@apple.com	Vendor Advisory
https://support.apple.com/en-us/HT211947	product-security@apple.com	Vendor Advisory
http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
http://seclists.org/fulldisclosure/2020/Dec/32	af854a3a-2127-422b-91ae-364da2661108	Mailing List Third Party Advisory
https://support.apple.com/en-us/HT211928	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://support.apple.com/en-us/HT211929	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://support.apple.com/en-us/HT211931	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://support.apple.com/en-us/HT211940	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://support.apple.com/en-us/HT211944	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://support.apple.com/en-us/HT211945	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://support.apple.com/en-us/HT211946	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory
https://support.apple.com/en-us/HT211947	af854a3a-2127-422b-91ae-364da2661108	Vendor Advisory

Hyperlink: http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html

Source: product-security@apple.com

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://seclists.org/fulldisclosure/2020/Dec/32

Source: product-security@apple.com

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://support.apple.com/en-us/HT211928

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211929

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211931

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211940

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211944

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211945

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211946

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211947

Source: product-security@apple.com

Resource:

Vendor Advisory

Hyperlink: http://packetstormsecurity.com/files/161295/XNU-Kernel-Turnstiles-Type-Confusion.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Third Party Advisory

VDB Entry

Hyperlink: http://seclists.org/fulldisclosure/2020/Dec/32

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Mailing List

Third Party Advisory

Hyperlink: https://support.apple.com/en-us/HT211928

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211929

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211931

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211940

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211944

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211945

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211946

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Hyperlink: https://support.apple.com/en-us/HT211947

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Vendor Advisory

Similar CVEs

3204Records found

CVE-2011-0611

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-93.70% / 99.84%

7 Day CHG~0.00%

Published-13 Apr, 2011 | 14:00

Updated-30 Jul, 2025 | 01:47

Known KEV||Action Due Date - 2022-03-24||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib.bundle) in Adobe Reader 9.x before 9.4.4 and 10.x through 10.0.1 on Windows, Adobe Reader 9.x before 9.4.4 and 10.x before 10.0.3 on Mac OS X, and Adobe Acrobat 9.x before 9.4.4 and 10.x before 10.0.3 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Flash content; as demonstrated by a Microsoft Office document with an embedded .swf file that has a size inconsistency in a "group of included constants," object type confusion, ActionScript that adds custom functions to prototypes, and Date objects; and as exploited in the wild in April 2011.

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-0985

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-53.05% / 97.87%

7 Day CHG~0.00%

Published-10 Feb, 2016 | 20:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0.0.260, Adobe AIR SDK before 20.0.0.260, and Adobe AIR SDK & Compiler before 20.0.0.260 allow attackers to execute arbitrary code by leveraging an unspecified "type confusion."

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-1015

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-7.25% / 91.25%

7 Day CHG~0.00%

Published-09 Apr, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux allows attackers to execute arbitrary code by overriding NetConnection object properties to leverage an unspecified "type confusion," a different vulnerability than CVE-2016-1019.

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2018-4920

Matching Score-10

Matching Score-10

Product-linux_kernel windows_8.1 chrome_os mac_os_x windows flash_player_desktop_runtime windows_10 flash_player Adobe Flash Player 28.0.0.161 and earlier versions

CVSS Score-8.8||HIGH

EPSS-4.09% / 88.10%

7 Day CHG~0.00%

Published-19 May, 2018 | 17:00

Updated-05 Aug, 2024 | 05:18

Adobe Flash Player versions 28.0.0.161 and earlier have an exploitable type confusion vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.

Vendor-n/a Google LLC Adobe Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2022-46706

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 6.89%

7 Day CHG~0.00%

Published-14 Aug, 2023 | 22:40

Updated-09 Oct, 2024 | 14:31

A type confusion issue was addressed with improved state handling. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos mac_os_x Security Update - Catalina macOS macos securtiy_update_catalina

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2021-30859

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.27% / 49.99%

7 Day CHG~0.00%

Published-24 Aug, 2021 | 18:49

Updated-03 Aug, 2024 | 22:48

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6, Security Update 2021-005 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-iphone_os macos mac_os_x ipados macOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2021-30869

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-4.23% / 88.31%

7 Day CHG~0.00%

Published-24 Aug, 2021 | 18:49

Updated-30 Jul, 2025 | 01:38

Known KEV||Action Due Date - 2021-11-17||Apply updates per vendor instructions.

A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5, iOS 14.4 and iPadOS 14.4, macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.

Vendor-Apple Inc.

Product-macos iphone_os ipados mac_os_x iOS and iPadOS macOS iOS, iPadOS, and macOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-41075

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.14% / 34.56%

7 Day CHG~0.00%

Published-10 Jan, 2024 | 22:03

Updated-26 Aug, 2024 | 20:35

A type confusion issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.7.5, macOS Ventura 13.3, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, macOS Monterey 12.6.4. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-iphone_os macos ipados macOS iOS and iPadOS macos ipados

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-30310

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.03% / 7.90%

7 Day CHG~0.00%

Published-13 May, 2025 | 16:53

Updated-14 May, 2025 | 14:28

Dreamweaver Desktop | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)

Dreamweaver Desktop versions 21.4 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Microsoft Corporation Adobe Inc.Apple Inc.

Product-dreamweaver macos windows Dreamweaver Desktop

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2025-24213

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.03% / 5.71%

7 Day CHG~0.00%

Published-31 Mar, 2025 | 22:23

Updated-13 May, 2025 | 17:15

This issue was addressed with improved handling of floats. This issue is fixed in tvOS 18.5, Safari 18.5, iPadOS 17.7.7, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, watchOS 11.5, visionOS 2.5. A type confusion issue could lead to memory corruption.

Vendor-Apple Inc.

Product-ipados macos iphone_os tvos safari macOS visionOS tvOS iPadOS watchOS Safari iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2012-0752

Matching Score-10

Matching Score-10

CVSS Score-9.3||HIGH

EPSS-6.42% / 90.66%

7 Day CHG~0.00%

Published-16 Feb, 2012 | 19:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) by leveraging an unspecified "type confusion."

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Oracle Corporation Apple Inc.Adobe Inc.

Product-linux_kernel windows solaris android flash_player mac_os_x n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2022-42841

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.10% / 29.01%

7 Day CHG~0.00%

Published-15 Dec, 2022 | 00:00

Updated-21 Apr, 2025 | 17:15

A type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. Processing a maliciously crafted package may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2022-34221

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.24% / 46.33%

7 Day CHG~0.00%

Published-15 Jul, 2022 | 15:33

Updated-16 Sep, 2024 | 23:22

Adobe Acrobat Reader Type Confusion vulnerability could lead to Arbitrary code execution

Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2022-32915

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 14.23%

7 Day CHG~0.00%

Published-01 Nov, 2022 | 00:00

Updated-06 May, 2025 | 20:15

A type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos macOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2024-45112

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-0.05% / 15.73%

7 Day CHG~0.00%

Published-13 Sep, 2024 | 08:58

Updated-19 Sep, 2024 | 14:56

Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)

Acrobat Reader versions 24.002.21005, 24.001.30159, 20.005.30655, 24.003.20054 and earlier are affected by a Type Confusion vulnerability that could result in arbitrary code execution in the context of the current user. This issue occurs when a resource is accessed using a type that is not compatible with the actual object type, leading to a logic error that an attacker could exploit. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Product-acrobat_dc acrobat_reader acrobat acrobat_reader_dc windows macos Acrobat Reader acrobat_dc acrobat_reader acrobat_reader_dc acrobat

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2023-27930

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.05% / 16.75%

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-05 Dec, 2024 | 18:43

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5 and iPadOS 16.5, watchOS 9.5, tvOS 16.5, macOS Ventura 13.4. An app may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados macos watchOS tvOS macOS iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2017-2995

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-4.72% / 88.96%

7 Day CHG~0.00%

Published-15 Feb, 2017 | 06:11

Updated-20 Apr, 2025 | 01:37

Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable type confusion vulnerability related to the MessageChannel class. Successful exploitation could lead to arbitrary code execution.

Vendor-n/a Linux Kernel Organization, Inc Apple Inc.Adobe Inc.Microsoft Corporation Google LLC

Product-chrome_os linux_kernel flash_player_desktop_runtime windows_8.1 windows windows_10 flash_player mac_os_x Adobe Flash Player 24.0.0.194 and earlier.

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2020-3853

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.41% / 60.74%

7 Day CHG~0.00%

Published-27 Feb, 2020 | 20:45

Updated-04 Aug, 2024 | 07:44

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1, macOS Catalina 10.15.3, tvOS 13.3.1, watchOS 6.1.2. A malicious application may be able to execute arbitrary code with system privileges.

Vendor-Apple Inc.

Product-iphone_os watchos tvos ipados mac_os_x tvOS macOS watchOS iOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2022-22661

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.28% / 50.81%

7 Day CHG+0.03%

Published-18 Mar, 2022 | 18:00

Updated-03 Aug, 2024 | 03:21

A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.6.5, macOS Monterey 12.3, Security Update 2022-003 Catalina. An application may be able to execute arbitrary code with kernel privileges.

Vendor-Apple Inc.

Product-macos mac_os_x macOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-8250

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-8.30% / 91.90%

7 Day CHG~0.00%

Published-06 Jul, 2020 | 17:38

Updated-04 Aug, 2024 | 21:17

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-acrobat_dc macos windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-8506

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-16.05% / 94.52%

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-30 Jul, 2025 | 01:45

Known KEV||Action Due Date - 2022-05-25||Apply updates per vendor instructions.

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.Red Hat, Inc.

Product-itunes tvos enterprise_linux_desktop safari enterprise_linux_workstation enterprise_linux_server watchos iphone_os icloud watchOS iTunes for Windows iOS tvOS iCloud for Windows Safari Multiple Products

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-8249

Matching Score-10

Matching Score-10

CVSS Score-7.8||HIGH

EPSS-8.30% / 91.90%

7 Day CHG~0.00%

Published-06 Jul, 2020 | 17:38

Updated-04 Aug, 2024 | 21:17

Product-acrobat_dc macos windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-7820

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-19.29% / 95.14%

7 Day CHG~0.00%

Published-22 May, 2019 | 15:42

Updated-04 Aug, 2024 | 21:02

Adobe Acrobat and Reader versions 2019.010.20100 and earlier, 2019.010.20099 and earlier, 2017.011.30140 and earlier, 2017.011.30138 and earlier, 2015.006.30495 and earlier, and 2015.006.30493 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2019-7069

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-12.97% / 93.80%

7 Day CHG~0.00%

Published-24 May, 2019 | 18:54

Updated-04 Aug, 2024 | 20:38

Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .

Product-mac_os_x acrobat_dc windows acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2021-30954

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.34% / 55.83%

7 Day CHG~0.00%

Published-24 Aug, 2021 | 18:50

Updated-03 Aug, 2024 | 22:48

A type confusion issue was addressed with improved memory handling. This issue is fixed in tvOS 15.2, macOS Monterey 12.1, Safari 15.2, iOS 15.2 and iPadOS 15.2, watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Debian GNU/Linux Fedora Project Apple Inc.

Product-iphone_os debian_linux ipados tvos watchos safari fedora macos watchOS macOS iOS and iPadOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-6992

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-8.85% / 92.18%

7 Day CHG~0.00%

Published-13 Oct, 2016 | 19:00

Updated-12 Apr, 2025 | 10:46

Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code by leveraging an unspecified "type confusion."

Vendor-n/a Adobe Inc.Linux Kernel Organization, Inc Google LLC Apple Inc.Microsoft Corporation

Product-flash_player chrome_os linux_kernel flash_player_desktop_runtime windows windows_8.1 mac_os_x windows_10 n/a

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-4149

Matching Score-10

Matching Score-10

CVSS Score-8.8||HIGH

EPSS-2.95% / 85.92%

7 Day CHG+0.77%

Published-16 Jun, 2016 | 14:00

Updated-12 Apr, 2025 | 10:46

Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-083.

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2020-3897

Matching Score-10

Assigner-Apple Inc.

Matching Score-10

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-2.49% / 84.70%

7 Day CHG~0.00%

Published-01 Apr, 2020 | 17:49

Updated-04 Aug, 2024 | 07:52

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, watchOS 6.2, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A remote attacker may be able to cause arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os ipad_os watchos tvos safari icloud iTunes for Windows watchOS iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2020-3757

Matching Score-10

Matching Score-10

Vendor-Google LLC Adobe Inc.Red Hat, Inc.Apple Inc.Microsoft Corporation Linux Kernel Organization, Inc

CVSS Score-8.8||HIGH

EPSS-5.41% / 89.75%

7 Day CHG~0.00%

Published-13 Feb, 2020 | 15:52

Updated-04 Aug, 2024 | 07:44

Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution.

Product-enterprise_linux_server linux_kernel windows_8.1 enterprise_linux_workstation chrome_os windows macos windows_10 enterprise_linux_desktop flash_player Adobe Flash Player

CWE ID-CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CVE-2016-1797

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.22% / 44.88%

7 Day CHG+0.08%

Published-20 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

Apple Type Services (ATS) in Apple OS X before 10.11.5 allows attackers to bypass intended FontValidator sandbox-policy restrictions and execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-284

Improper Access Control

CVE-2024-30282

Matching Score-8

Matching Score-8

CVSS Score-7.8||HIGH

EPSS-0.09% / 26.66%

7 Day CHG~0.00%

Published-16 May, 2024 | 08:59

Updated-02 Dec, 2024 | 17:48

Adobe Animate 2024 Out of Bound Write Remote Code Execution Vulnerability

Animate versions 24.0.2, 23.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Product-windows animate macos Animate animate

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-1828

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-5.15% / 89.48%

7 Day CHG-4.49%

Published-20 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

The kernel in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2016-1827, CVE-2016-1829, and CVE-2016-1830.

Vendor-n/a Apple Inc.

Product-mac_os_x iphone_os watchos tvos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-1804

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.34% / 55.92%

7 Day CHG-0.31%

Published-20 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

The Multi-Touch subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-2833

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-9.3||HIGH

EPSS-1.78% / 81.93%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2.

Vendor-n/a Apple Inc.

Product-iphone_os itunes n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-2825

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-9.3||HIGH

EPSS-3.94% / 87.86%

7 Day CHG~0.00%

Published-29 Aug, 2011 | 15:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving custom fonts.

Vendor-n/a Google LLC Apple Inc.

Product-iphone_os itunes safari chrome n/a

CWE ID-CWE-416

Use After Free

CVE-2010-2883

Matching Score-8

Matching Score-8

CVSS Score-7.3||HIGH

EPSS-93.25% / 99.80%

7 Day CHG~0.00%

Published-09 Sep, 2010 | 21:00

Updated-30 Jul, 2025 | 01:47

Known KEV||Action Due Date - 2022-06-22||Apply updates per vendor instructions.

Stack-based buffer overflow in CoolType.dll in Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a PDF document with a long field in a Smart INdependent Glyphlets (SING) table in a TTF font, as exploited in the wild in September 2010. NOTE: some of these details are obtained from third party information.

Vendor-n/a Microsoft Corporation Adobe Inc.Apple Inc.

Product-windows acrobat_reader acrobat macos n/a Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

CVE-2016-1757

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7||HIGH

EPSS-58.45% / 98.12%

7 Day CHG~0.00%

Published-24 Mar, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x n/a

CWE ID-CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVE-2010-3257

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-12.15% / 93.56%

7 Day CHG~0.00%

Published-07 Sep, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element focus.

Vendor-webkitgtk n/a Apple Inc.Canonical Ltd.Google LLC

Product-ubuntu_linux iphone_os safari chrome webkitgtk n/a

CWE ID-CWE-416

Use After Free

CVE-2011-2869

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-9.3||HIGH

EPSS-1.85% / 82.25%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Apple Inc.

Product-iphone_os itunes n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-3252

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-6.69% / 90.86%

7 Day CHG~0.00%

Published-12 Oct, 2011 | 18:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in CoreAudio, as used in Apple iTunes before 10.5, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Advanced Audio Coding (AAC) stream.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 windows_xp itunes windows_vista n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-2666

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-4.06% / 88.06%

7 Day CHG~0.00%

Published-07 Jul, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Opera before 10.54 on Windows and Mac OS X does not properly enforce permission requirements for widget filesystem access and directory selection, which allows user-assisted remote attackers to create or modify arbitrary files, and consequently execute arbitrary code, via widget File I/O operations.

Vendor-n/a Microsoft Corporation Apple Inc.Opera

Product-windows opera_browser mac_os_x n/a

CVE-2016-1792

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.21% / 44.03%

7 Day CHG-0.15%

Published-20 May, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

The AMD subsystem in Apple OS X before 10.11.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Vendor-n/a Apple Inc.

Product-mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-2870

Matching Score-8

Assigner-Chrome

Matching Score-8

Assigner-Chrome

CVSS Score-9.3||HIGH

EPSS-1.85% / 82.25%

7 Day CHG~0.00%

Published-08 Mar, 2012 | 22:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Apple Inc.

Product-iphone_os itunes n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-2657

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-0.66% / 70.27%

7 Day CHG~0.00%

Published-07 Jul, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Opera before 10.60 on Windows and Mac OS X does not properly prevent certain double-click operations from running a program located on a web site, which allows user-assisted remote attackers to execute arbitrary code via a crafted web page that bypasses a dialog.

Vendor-n/a Microsoft Corporation Apple Inc.Opera

Product-windows opera_browser macos n/a

CVE-2016-5330

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-7.8||HIGH

EPSS-29.61% / 96.45%

7 Day CHG~0.00%

Published-08 Aug, 2016 | 01:00

Updated-12 Apr, 2025 | 10:46

Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.

Vendor-n/a Apple Inc.VMware (Broadcom Inc.)Microsoft Corporation

Product-esxi workstation_player fusion workstation_pro tools windows mac_os_x n/a

CWE ID-CWE-426

Untrusted Search Path

CVE-2016-4698

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.24% / 46.84%

7 Day CHG~0.00%

Published-25 Sep, 2016 | 10:00

Updated-12 Apr, 2025 | 10:46

AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inheritance policy, which allows attackers to execute arbitrary code in a privileged context via a crafted app.

Vendor-n/a Apple Inc.

Product-iphone_os mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2010-2208

Matching Score-8

Matching Score-8

CVSS Score-9.3||HIGH

EPSS-10.82% / 93.08%

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, dereference a heap object after this object's deletion, which allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2011-3081

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-7.35% / 91.32%

7 Day CHG~0.00%

Published-01 May, 2012 | 10:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the floating of elements, a different vulnerability than CVE-2011-3078.

Vendor-n/a Apple Inc.Google LLC

Product-itunes iphone_os safari chrome n/a

CWE ID-CWE-416

Use After Free

CVE-2010-1783

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-4.92% / 89.21%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle dynamic modification of a text node, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2016-4274

Matching Score-8

Matching Score-8