Apple Darwin Streaming Server vulnerabilities

27 CVEs affecting Apple Darwin Streaming Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-0749, published 2007-05-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2003-0050, published 2003-03-07. High severity, CVSS 7.5. EPSS: 68.9% chance of exploitation in the next 30 days. parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.
CVE-2007-0748, published 2007-05-13. High severity, CVSS 10.0. EPSS: 6.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Apple Darwin Streaming Proxy, when using Darwin Streaming Server before 5.5.5, allows remote attackers to execute arbitrary code via multiple trackID values in a SETUP…
CVE-2007-0749, published 2007-05-13. High severity, CVSS 10.0. EPSS: 6.5% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in the is_command function in proxy.c in Apple Darwin Streaming Proxy, when using Darwin Streaming Server before 5.5.5, allow remote attackers to execute…
CVE-2003-1414, published 2003-12-31. Medium severity, CVSS 4.3. EPSS: 4.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in parse_xml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remote attackers to read arbitrary files via a ... (triple dot)…
CVE-2004-0169, published 2004-03-15. Medium severity, CVSS 5.0. EPSS: 3.5% chance of exploitation in the next 30 days. QuickTime Streaming Server in MacOS X 10.2.8 and 10.3.2 allows remote attackers to cause a denial of service (crash) via DESCRIBE requests with long User-Agent fields, which causes an Assert error to…
CVE-2003-0426, published 2003-08-27. High severity, CVSS 10.0. EPSS: 3.4% chance of exploitation in the next 30 days. The installation of Apple QuickTime / Darwin Streaming Server before 4.1.3f starts the administration server with a "Setup Assistant" page that allows remote attackers to set the administrator…
CVE-2003-0502, published 2003-08-27. High severity, CVSS 10.0. EPSS: 3.4% chance of exploitation in the next 30 days. Apple QuickTime / Darwin Streaming Server before 4.1.3g allows remote attackers to cause a denial of service (crash) via a .. (dot dot) sequence followed by an MS-DOS device name (e.g. AUX) in a…
CVE-2004-1086, published 2004-12-02. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.
CVE-2003-0421, published 2003-08-27. High severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days. Apple QuickTime / Darwin Streaming Server before 4.1.3f allows remote attackers to cause a denial of service (crash) via an MS-DOS device name (e.g. AUX) in a request to HTTP port 1220, a different…
CVE-2003-0054, published 2003-03-07. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute certain code via a request to port 7070 with the script in an argument to…

Latest

CVE-2005-2195, published 2005-07-18. Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days. Apple Darwin Streaming Server 5.5 and earlier allows remote attackers to cause a denial of service (application crash) via a URL with a filename containing a .cgi extension and an MS-DOS device name…
CVE-2004-1123, published 2005-01-10. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. Darwin Streaming Server 5.0.1, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) via a DESCRIBE request with a location that contains a null byte.
CVE-2004-1083, published 2004-12-03. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote…
CVE-2004-1089, published 2004-12-02. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Unknown vulnerability in Apple Mac OS X 10.3.6 server, when using Kerberos authentication and Cyrus IMAP allows local users to access mailboxes of other users.
CVE-2004-1088, published 2004-12-02. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Postfix server for Apple Mac OS X 10.3.6, when using CRAM-MD5, allows remote attackers to send mail without authentication by replaying authentication information.
CVE-2004-1087, published 2004-12-02. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Terminal for Apple Mac OS X 10.3.6 may indicate that "Secure Keyboard Entry" is enabled even when it is not, which could result in a false sense of security for the user.
CVE-2004-1085, published 2004-12-02. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. Human Interface Toolbox (HIToolBox) for Apple Mac 0S X 10.3.6 allows local users to exit applications via the force-quit key combination, even when the system is running in kiosk mode.