Apple Quicktime Streaming Server vulnerabilities

16 CVEs affecting Apple Quicktime Streaming Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2004-1123, published 2005-01-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2003-0050, published 2003-03-07. High severity, CVSS 7.5. EPSS: 68.9% chance of exploitation in the next 30 days. parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.
CVE-2003-1414, published 2003-12-31. Medium severity, CVSS 4.3. EPSS: 4.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in parse_xml.cg Apple Darwin Streaming Server 4.1.2 and Apple Quicktime Streaming Server 4.1.1 allows remote attackers to read arbitrary files via a ... (triple dot)…
CVE-2004-1086, published 2004-12-02. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. Buffer overflow in PSNormalizer for Apple Mac OS X 10.3.6 allows remote attackers to execute arbitrary code via a crafted PostScript input file.
CVE-2003-0054, published 2003-03-07. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute certain code via a request to port 7070 with the script in an argument to…
CVE-2003-0051, published 2003-03-07. Medium severity, CVSS 5.0. EPSS: 2.1% chance of exploitation in the next 30 days. parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to obtain the physical path of the server's installation path via a…
CVE-2004-1083, published 2004-12-03. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Apache for Apple Mac OS X 10.2.8 and 10.3.6 restricts access to files in a case sensitive manner, but the Apple HFS+ filesystem accesses files in a case insensitive manner, which allows remote…
CVE-2003-0053, published 2003-03-07. Medium severity, CVSS 4.3. EPSS: 1.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to insert arbitrary script…
CVE-2004-1088, published 2004-12-02. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. Postfix server for Apple Mac OS X 10.3.6, when using CRAM-MD5, allows remote attackers to send mail without authentication by replaying authentication information.
CVE-2004-1084, published 2004-12-02. Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days. Apache for Apple Mac OS X 10.2.8 and 10.3.6 allows remote attackers to read files and resource fork content via HTTP requests to certain special file names related to multiple data streams in HFS+,…
CVE-2003-0052, published 2003-03-07. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to list arbitrary directories.

Latest

CVE-2004-1123, published 2005-01-10. Medium severity, CVSS 5.0. EPSS: 1.3% chance of exploitation in the next 30 days. Darwin Streaming Server 5.0.1, and possibly earlier versions, allows remote attackers to cause a denial of service (server crash) via a DESCRIBE request with a location that contains a null byte.
CVE-2004-1089, published 2004-12-02. Medium severity, CVSS 4.6. EPSS: 0.3% chance of exploitation in the next 30 days. Unknown vulnerability in Apple Mac OS X 10.3.6 server, when using Kerberos authentication and Cyrus IMAP allows local users to access mailboxes of other users.
CVE-2004-1087, published 2004-12-02. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. Terminal for Apple Mac OS X 10.3.6 may indicate that "Secure Keyboard Entry" is enabled even when it is not, which could result in a false sense of security for the user.
CVE-2004-1085, published 2004-12-02. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. Human Interface Toolbox (HIToolBox) for Apple Mac 0S X 10.3.6 allows local users to exit applications via the force-quit key combination, even when the system is running in kiosk mode.
CVE-2004-1081, published 2004-12-02. Low severity, CVSS 2.1. EPSS: 0.3% chance of exploitation in the next 30 days. The Application Framework (AppKit) for Apple Mac OS X 10.2.8 and 10.3.6 does not properly restrict access to a secure text input field, which allows local users to read keyboard input from other…