# CVEs published 2015-09-18

113 CVEs were published on September 18, 2015: 0 critical, 0 high. Days are UTC.

- [CVE-2015-3962](https://cve.now/CVE-2015-3962.md): Schneider Electric StruxureWare Building Expert MPM before 2.15 does not use encryption for the client-server data stream, which allows remo (no CVSS)
- [CVE-2015-6294](https://cve.now/CVE-2015-6294.md): Cisco IOS 15.2(3)E and earlier and IOS XE 3.6(2)E and earlier allow remote attackers to cause a denial of service (functionality loss) via c (no CVSS)
- [CVE-2015-6296](https://cve.now/CVE-2015-6296.md): Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and 8.3(2) has a default account, which allows local users to obtain root access by l (no CVSS)
- [CVE-2015-6297](https://cve.now/CVE-2015-6297.md): The DHCPv6 server in Cisco IOS on ASR 9000 devices with software 5.2.0 Base allows remote attackers to cause a denial of service (process re (no CVSS)
- [CVE-2015-6456](https://cve.now/CVE-2015-6456.md): GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remot (no CVSS)
- [CVE-2015-6459](https://cve.now/CVE-2015-6459.md): Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Ente (no CVSS)
- [CVE-2015-6460](https://cve.now/CVE-2015-6460.md): Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.34 allow remote attackers to execute arbitrary code via (no CVSS, 3S-Smart CODESYS Gateway Server)
- [CVE-2015-6932](https://cve.now/CVE-2015-6932.md): VMware vCenter Server 5.5 before u3 and 6.0 before u1 does not verify X.509 certificates from TLS LDAP servers, which allows man-in-the-midd (no CVSS)
- [CVE-2015-6939](https://cve.now/CVE-2015-6939.md): Cross-site scripting (XSS) vulnerability in the login module in Joomla! 3.4.x before 3.4.4 allows remote attackers to inject arbitrary web s (no CVSS)
- [CVE-2015-7243](https://cve.now/CVE-2015-7243.md): Buffer overflow in Boxoft WAV to MP3 Converter allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary c (no CVSS)
- [CVE-2015-4638](https://cve.now/CVE-2015-4638.md): The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.3.0 through 11.5.2 and 11.6.0 th (no CVSS)
- [CVE-2015-5274](https://cve.now/CVE-2015-5274.md): rubygem-openshift-origin-console in Red Hat OpenShift 2.2 allows remote authenticated users to execute arbitrary commands via a crafted requ (no CVSS)
- [CVE-2015-7237](https://cve.now/CVE-2015-7237.md): Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to o (no CVSS)
- [CVE-2015-7238](https://cve.now/CVE-2015-7238.md): The Secondary server in Threat Intelligence Exchange (TIE) before 1.2.0 uses weak permissions for unspecified (1) configuration files and (2 (no CVSS)
- [CVE-2015-7239](https://cve.now/CVE-2015-7239.md): SQL injection vulnerability in the BP\_FIND\_JOBS\_WITH\_PROGRAM function module in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to ex (no CVSS)
- [CVE-2014-8611](https://cve.now/CVE-2014-8611.md): The \_\_sflush function in fflush.c in stdio in libc in FreeBSD 10.1 and the kernel in Apple iOS before 9 mishandles failures of the write sys (no CVSS)
- [CVE-2015-3801](https://cve.now/CVE-2015-3801.md): The document.cookie API implementation in the CFNetwork Cookies subsystem in WebKit in Apple iOS before 9 allows remote attackers to bypass (no CVSS)
- [CVE-2015-5764](https://cve.now/CVE-2015-5764.md): The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability (no CVSS)
- [CVE-2015-5765](https://cve.now/CVE-2015-5765.md): The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability (no CVSS)
- [CVE-2015-5767](https://cve.now/CVE-2015-5767.md): The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability (no CVSS)
- [CVE-2015-5788](https://cve.now/CVE-2015-5788.md): The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image i (no CVSS)
- [CVE-2015-5789](https://cve.now/CVE-2015-5789.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5790](https://cve.now/CVE-2015-5790.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5791](https://cve.now/CVE-2015-5791.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5792](https://cve.now/CVE-2015-5792.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5793](https://cve.now/CVE-2015-5793.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5794](https://cve.now/CVE-2015-5794.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5795](https://cve.now/CVE-2015-5795.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5796](https://cve.now/CVE-2015-5796.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5797](https://cve.now/CVE-2015-5797.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5798](https://cve.now/CVE-2015-5798.md): WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS)
- [CVE-2015-5799](https://cve.now/CVE-2015-5799.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5800](https://cve.now/CVE-2015-5800.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5801](https://cve.now/CVE-2015-5801.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5802](https://cve.now/CVE-2015-5802.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5803](https://cve.now/CVE-2015-5803.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5804](https://cve.now/CVE-2015-5804.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5805](https://cve.now/CVE-2015-5805.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5806](https://cve.now/CVE-2015-5806.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5807](https://cve.now/CVE-2015-5807.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5808](https://cve.now/CVE-2015-5808.md): WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS)
- [CVE-2015-5809](https://cve.now/CVE-2015-5809.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5810](https://cve.now/CVE-2015-5810.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5811](https://cve.now/CVE-2015-5811.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5812](https://cve.now/CVE-2015-5812.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5813](https://cve.now/CVE-2015-5813.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5814](https://cve.now/CVE-2015-5814.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5815](https://cve.now/CVE-2015-5815.md): WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memo (no CVSS)
- [CVE-2015-5816](https://cve.now/CVE-2015-5816.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5817](https://cve.now/CVE-2015-5817.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5818](https://cve.now/CVE-2015-5818.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5819](https://cve.now/CVE-2015-5819.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5820](https://cve.now/CVE-2015-5820.md): WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime- (no CVSS)
- [CVE-2015-5821](https://cve.now/CVE-2015-5821.md): WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (no CVSS)
- [CVE-2015-5822](https://cve.now/CVE-2015-5822.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5823](https://cve.now/CVE-2015-5823.md): WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a (no CVSS)
- [CVE-2015-5824](https://cve.now/CVE-2015-5824.md): The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers a (no CVSS)
- [CVE-2015-5825](https://cve.now/CVE-2015-5825.md): WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain s (no CVSS)
- [CVE-2015-5826](https://cve.now/CVE-2015-5826.md): WebKit in Apple iOS before 9 does not properly select the cases in which a Cascading Style Sheets (CSS) document is required to have the tex (no CVSS)
- [CVE-2015-5827](https://cve.now/CVE-2015-5827.md): WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (no CVSS)
- [CVE-2015-5829](https://cve.now/CVE-2015-5829.md): Data Detectors Engine in Apple iOS before 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruptio (no CVSS)
- [CVE-2015-5831](https://cve.now/CVE-2015-5831.md): NetworkExtension in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows attackers to o (no CVSS)
- [CVE-2015-5832](https://cve.now/CVE-2015-5832.md): The iTunes Store component in Apple iOS before 9 does not properly delete AppleID credentials from the keychain upon a signout action, which (no CVSS)
- [CVE-2015-5834](https://cve.now/CVE-2015-5834.md): IOAcceleratorFamily in Apple iOS before 9 allows attackers to obtain sensitive kernel memory-layout information via a crafted app. (no CVSS)
- [CVE-2015-5835](https://cve.now/CVE-2015-5835.md): Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an interce (no CVSS)
- [CVE-2015-5837](https://cve.now/CVE-2015-5837.md): PluginKit in Apple iOS before 9 allows attackers to bypass an intended app-trust requirement and install arbitrary extensions via a crafted (no CVSS)
- [CVE-2015-5838](https://cve.now/CVE-2015-5838.md): SpringBoard in Apple iOS before 9 does not properly restrict access to privileged API calls, which allows attackers to spoof the dialog wind (no CVSS)
- [CVE-2015-5839](https://cve.now/CVE-2015-5839.md): dyld in Apple iOS before 9 allows attackers to bypass a code-signing protection mechanism via an app that places a crafted signature in an e (no CVSS)
- [CVE-2015-5840](https://cve.now/CVE-2015-5840.md): The checkint division routines in removefile in Apple iOS before 9 allow attackers to cause a denial of service (overflow fault and app cras (no CVSS)
- [CVE-2015-5841](https://cve.now/CVE-2015-5841.md): The CFNetwork Proxies component in Apple iOS before 9 does not properly handle a Set-Cookie header within a response to an HTTP CONNECT requ (no CVSS)
- [CVE-2015-5842](https://cve.now/CVE-2015-5842.md): XNU in the kernel in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows local users to obtain sensi (no CVSS)
- [CVE-2015-5843](https://cve.now/CVE-2015-5843.md): IOMobileFrameBuffer in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspeci (no CVSS)
- [CVE-2015-5844](https://cve.now/CVE-2015-5844.md): IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (m (no CVSS)
- [CVE-2015-5845](https://cve.now/CVE-2015-5845.md): IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (m (no CVSS)
- [CVE-2015-5846](https://cve.now/CVE-2015-5846.md): IOKit in the kernel in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (m (no CVSS)
- [CVE-2015-5847](https://cve.now/CVE-2015-5847.md): The Disk Images component in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via u (no CVSS)
- [CVE-2015-5848](https://cve.now/CVE-2015-5848.md): IOAcceleratorFamily in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspeci (no CVSS)
- [CVE-2015-5850](https://cve.now/CVE-2015-5850.md): AppleKeyStore in Apple iOS before 9 allows physically proximate attackers to reset the count of incorrect passcode attempts via a device bac (no CVSS)
- [CVE-2015-5851](https://cve.now/CVE-2015-5851.md): The convenience initializer in the Multipeer Connectivity component in Apple iOS before 9 does not require an encrypted session, which allow (no CVSS)
- [CVE-2015-5855](https://cve.now/CVE-2015-5855.md): Apple iOS before 9 allows attackers to discover the e-mail address of a player via a crafted Game Center app. (no CVSS)
- [CVE-2015-5856](https://cve.now/CVE-2015-5856.md): The Application Store component in Apple iOS before 9 allows remote attackers to cause a denial of service to an enterprise-signed app via a (no CVSS)
- [CVE-2015-5857](https://cve.now/CVE-2015-5857.md): Mail in Apple iOS before 9 allows remote attackers to use an address-book contact as a spoofed e-mail sender address via unspecified vectors (no CVSS)
- [CVE-2015-5858](https://cve.now/CVE-2015-5858.md): The CFNetwork HTTPProtocol component in Apple iOS before 9 allows remote attackers to bypass the HSTS protection mechanism, and consequently (no CVSS)
- [CVE-2015-5860](https://cve.now/CVE-2015-5860.md): The CFNetwork HTTPProtocol component in Apple iOS before 9 mishandles HSTS state, which allows remote attackers to bypass the Safari private (no CVSS)
- [CVE-2015-5861](https://cve.now/CVE-2015-5861.md): SpringBoard in Apple iOS before 9 allows physically proximate attackers to bypass a lock-screen preview-disabled setting, and reply to an au (no CVSS)
- [CVE-2015-5862](https://cve.now/CVE-2015-5862.md): The Audio component in Apple iOS before 9 allows remote attackers to cause a denial of service (memory corruption and application crash) via (no CVSS)
- [CVE-2015-5863](https://cve.now/CVE-2015-5863.md): IOStorageFamily in Apple iOS before 9 does not properly initialize an unspecified data structure, which allows local users to obtain sensiti (no CVSS)
- [CVE-2015-5867](https://cve.now/CVE-2015-5867.md): IOHIDFamily in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory co (no CVSS)
- [CVE-2015-5868](https://cve.now/CVE-2015-5868.md): The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vect (no CVSS)
- [CVE-2015-5869](https://cve.now/CVE-2015-5869.md): The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in Apple iOS before 9 allows remote attackers to reconfigure a hop-lim (no CVSS)
- [CVE-2015-5874](https://cve.now/CVE-2015-5874.md): CoreText in Apple iOS before 9 and iTunes before 12.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory (no CVSS)
- [CVE-2015-5876](https://cve.now/CVE-2015-5876.md): dyld in Dev Tools in Apple iOS before 9 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (mem (no CVSS)
- [CVE-2015-5879](https://cve.now/CVE-2015-5879.md): XNU in the kernel in Apple iOS before 9 does not properly validate the headers of TCP packets, which allows remote attackers to bypass the s (no CVSS)
- [CVE-2015-5880](https://cve.now/CVE-2015-5880.md): CoreAnimation in Apple iOS before 9 allows attackers to bypass intended IOSurface restrictions and obtain screen-framebuffer access via a cr (no CVSS)
- [CVE-2015-5882](https://cve.now/CVE-2015-5882.md): The processor\_set\_tasks API implementation in Apple iOS before 9 allows local users to bypass an entitlement protection mechanism and obtain (no CVSS)
- [CVE-2015-5885](https://cve.now/CVE-2015-5885.md): The CFNetwork Cookies component in Apple iOS before 9 allows remote attackers to track users via vectors involving a cookie for a top-level (no CVSS)
- [CVE-2015-5892](https://cve.now/CVE-2015-5892.md): Siri in Apple iOS before 9 allows physically proximate attackers to bypass an intended client-side protection mechanism and obtain sensitive (no CVSS)
- [CVE-2015-5895](https://cve.now/CVE-2015-5895.md): Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors. (no CVSS)
- [CVE-2015-5896](https://cve.now/CVE-2015-5896.md): The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vect (no CVSS)
- [CVE-2015-5898](https://cve.now/CVE-2015-5898.md): CFNetwork in Apple iOS before 9 relies on the hardware UID for its cache encryption key, which makes it easier for physically proximate atta (no CVSS)
- [CVE-2015-5899](https://cve.now/CVE-2015-5899.md): libpthread in the kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via un (no CVSS)
- [CVE-2015-5903](https://cve.now/CVE-2015-5903.md): The kernel in Apple iOS before 9 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vect (no CVSS)
- [CVE-2015-5904](https://cve.now/CVE-2015-5904.md): Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted web site. (no CVSS)
- [CVE-2015-5905](https://cve.now/CVE-2015-5905.md): Safari in Apple iOS before 9 allows remote attackers to spoof the relationship between URLs and web content via a crafted window opener on a (no CVSS)
- [CVE-2015-5906](https://cve.now/CVE-2015-5906.md): The HTML form implementation in WebKit in Apple iOS before 9 does not prevent QuickType access to the final character of a password, which m (no CVSS)
- [CVE-2015-5907](https://cve.now/CVE-2015-5907.md): WebKit in Apple iOS before 9 allows man-in-the-middle attackers to conduct redirection attacks by leveraging the mishandling of the resource (no CVSS)
- [CVE-2015-5909](https://cve.now/CVE-2015-5909.md): IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to ob (no CVSS)
- [CVE-2015-5910](https://cve.now/CVE-2015-5910.md): IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensiti (no CVSS)
- [CVE-2015-5911](https://cve.now/CVE-2015-5911.md): Multiple unspecified vulnerabilities in Twisted in Wiki Server in Apple OS X Server before 5.0.3 allow attackers to have an unknown impact v (no CVSS)
- [CVE-2015-5912](https://cve.now/CVE-2015-5912.md): The CFNetwork FTPProtocol component in Apple iOS before 9 allows remote FTP proxy servers to trigger TCP connection attempts to intranet hos (no CVSS)
- [CVE-2015-5916](https://cve.now/CVE-2015-5916.md): The Apple Pay component in Apple iOS before 9 allows remote terminals to obtain sensitive recent-transaction information during payments by (no CVSS)
- [CVE-2015-5920](https://cve.now/CVE-2015-5920.md): The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers to (no CVSS)
- [CVE-2015-5921](https://cve.now/CVE-2015-5921.md): WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obt (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.