Apple Cfnetwork vulnerabilities

5 CVEs affecting Apple Cfnetwork, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-0214, published 2011-07-21.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2010-1383, published 2011-07-21. High severity, CVSS 9.3. EPSS: 2.1% chance of exploitation in the next 30 days. CFNetwork in Apple Safari before 5.0.6 on Windows allows remote web servers to execute arbitrary code by replaying the NTLM credentials of a client user, related to a "credential reflection" issue.
CVE-2010-1420, published 2011-07-21. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in CFNetwork in Apple Safari before 5.0.6 allows remote attackers to inject arbitrary web script or HTML via a crafted text/plain file.
CVE-2007-2403, published 2007-08-03. Medium severity, CVSS 6.8. EPSS: 1.4% chance of exploitation in the next 30 days. CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmission of arbitrary FTP commands to arbitrary FTP servers.
CVE-2010-1800, published 2010-08-25. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. CFNetwork in Apple Mac OS X 10.6.3 and 10.6.4 supports anonymous SSL and TLS connections, which allows man-in-the-middle attackers to redirect a connection and obtain sensitive information via…
CVE-2011-0214, published 2011-07-21. Medium severity, CVSS 5.0. EPSS: 0.7% chance of exploitation in the next 30 days. CFNetwork in Apple Safari before 5.0.6 on Windows does not properly handle an untrusted attribute of a system root certificate, which allows remote web servers to bypass intended SSL restrictions via…