Apple OS X Server vulnerabilities

12 CVEs affecting Apple OS X Server, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-4754, published 2016-09-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability, published 2015-07-29. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2026-10-08. EPSS: 99.4% chance of exploitation in the next 30 days. named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.
CVE-2014-3583, published 2014-12-15. Medium severity, CVSS 5.0. EPSS: 10.8% chance of exploitation in the next 30 days. The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon…
CVE-2014-4424, published 2014-09-19. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. SQL injection vulnerability in Wiki Server in CoreCollaboration in Apple OS X Server before 2.2.3 and 3.x before 3.2.1 allows remote attackers to execute arbitrary SQL commands via unspecified…
CVE-2013-1034, published 2013-09-19. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Wiki Server in Apple Mac OS X Server before 2.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-4754, published 2016-09-25. High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days. ServerDocs Server in Apple OS X Server before 5.2 supports the RC4 cipher, which might allow remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
CVE-2015-1150, published 2015-04-28. Medium severity, CVSS 5.0. EPSS: 2% chance of exploitation in the next 30 days. The Firewall component in Apple OS X Server before 4.1 uses an incorrect pathname in configuration files, which allows remote attackers to bypass network-access restrictions by sending packets for…
CVE-2015-1151, published 2015-04-28. Medium severity, CVSS 5.0. EPSS: 1.9% chance of exploitation in the next 30 days. Wiki Server in Apple OS X Server before 4.1 allows remote attackers to bypass intended restrictions on Activity and People pages by connecting from an iPad client.
CVE-2014-4446, published 2014-10-18. Low severity, CVSS 2.1. EPSS: 1.4% chance of exploitation in the next 30 days. Mail Service in Apple OS X Server before 4.0 does not enforce SACL changes until after a service restart, which allows remote authenticated users to bypass intended access restrictions in…
CVE-2014-4406, published 2014-09-19. Medium severity, CVSS 6.1. EPSS: 1.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in Xcode Server in CoreCollaboration in Apple OS X Server before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-4694, published 2016-09-25. Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days. The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted CGI client data…

Latest

CVE-2014-4447, published 2014-10-18. Low severity, CVSS 1.9. EPSS: 0.3% chance of exploitation in the next 30 days. Profile Manager in Apple OS X Server before 4.0 allows local users to discover cleartext passwords by reading a file after a (1) profile setup or (2) profile edit occurs.