The version of Apple iTunes running on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper handling of error prototypes. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a maliciously crafted     website, to execute arbitrary code. (CVE-2016-4728)

  - An information disclosure vulnerability exists in WebKit     due to a permission issue caused by improper handling of     the location variable. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a maliciously crafted website, to disclose sensitive     information. (CVE-2016-4758)

  - Multiple memory corruption errors exist in WebKit due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, by convincing a user to visit a maliciously     crafted website, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-4759,     CVE-2016-4762, CVE-2016-4764, CVE-2016-4765,     CVE-2016-4766, CVE-2016-4767, CVE-2016-4768,     CVE-2016-4769)

  - A rebinding flaw exists in WebKit due to a failure to     restrict HTTP/0.9 responses to default ports and     cancel resource loads if a document is loaded with a     different HTTP protocol version. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a maliciously crafted website, to access     non-HTTP services. (CVE-2016-4760)

  - A security bypass vulnerability exists in WebKit in the     WKWebView component due to a failure to properly verify     X.509 certificates from HTTPS servers. A     man-in-the-middle attacker can exploit this, via a     specially crafted certificate, to spoof servers and     disclose or manipulate network traffic. (CVE-2016-4763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple Safari installed on the remote Mac OS X or macOS host is prior to 10.0. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist in WebKit that     allow an unauthenticated, remote attacker to cause a     denial of service condition or execute arbitrary code     via specially a crafted website. (CVE-2016-4611,     CVE-2016-4729, CVE-2016-4730, CVE-2016-4731,     CVE-2016-4734, CVE-2016-4735, CVE-2016-4737,     CVE-2016-4759, CVE-2016-4762, CVE-2016-4766,     CVE-2016-4767, CVE-2016-4768, CVE-2016-4769)

  - A cross-site scripting (XSS) vulnerability exists in the     Reader feature due to improper validation of     user-supplied input before returning it to users. An     unauthenticated, remote attacker can exploit this, by     convincing a user to follow a specially crafted link, to     execute arbitrary script code in a user's browser     session. (CVE-2016-4618)

  - A flaw exists in WebKit due to improper handling of     error prototypes. An unauthenticated, remote attacker     can exploit this, via a specially crafted website, to     execute arbitrary code. (CVE-2016-4728)

  - Multiple flaws exist in WebKit due to improper state     management. An unauthenticated, remote attacker     can exploit this, via a specially crafted website, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-4733, CVE-2016-4765)

  - An address bar spoofing vulnerability exists due to a     state management flaw related to sessions in tabs. An     unauthenticated, remote attacker can exploit this, via a     specially crafted website, to spoof an address in the     address bar. (CVE-2016-4751)

  - A flaw exists in WebKit due to improper handling of the     location variable. An unauthenticated, remote attacker     can exploit this, via a crafted website, to disclose     sensitive information. (CVE-2016-4758)

  - A flaw exists in WebKit that allows an unauthenticated,     remote attacker to conduct DNS rebinding attacks against     non-HTTP Safari sessions by leveraging HTTP/0.9 support.
    (CVE-2016-4760)

  - A flaw exists in WebKit in the WKWebView component due     to improper validation of X.509 certificates from HTTPS     servers. A man-in-the-middle attacker can exploit this,     via a crafted certificate, to disclose sensitive     information. (CVE-2016-4763)

The version of Apple iTunes installed on the remote Windows host is prior to 12.5.1. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists due to     improper handling of error prototypes. An     unauthenticated, remote attacker can exploit this, by     convincing a user to visit a maliciously crafted     website, to execute arbitrary code. (CVE-2016-4728)

  - An information disclosure vulnerability exists in WebKit     due to a permission issue caused by improper handling of     the location variable. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a maliciously crafted website, to disclose sensitive     information. (CVE-2016-4758)

  - Multiple memory corruption errors exist in WebKit due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     issues, by convincing a user to visit a maliciously     crafted website, to cause a denial of service condition     or the execution of arbitrary code. (CVE-2016-4759,     CVE-2016-4762, CVE-2016-4764, CVE-2016-4765,     CVE-2016-4766, CVE-2016-4767, CVE-2016-4768,     CVE-2016-4769)

  - A rebinding flaw exists in WebKit due to a failure to     restrict HTTP/0.9 responses to default ports and     cancel resource loads if a document is loaded with a     different HTTP protocol version. An unauthenticated,     remote attacker can exploit this, by convincing a user     to visit a maliciously crafted website, to access     non-HTTP services. (CVE-2016-4760)

  - A security bypass vulnerability exists in WebKit in the     WKWebView component due to a failure to properly verify     X.509 certificates from HTTPS servers. A     man-in-the-middle attacker can exploit this, via a     specially crafted certificate, to spoof servers and     disclose or manipulate network traffic. (CVE-2016-4763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of iOS running on the mobile device is prior to 10.0, and is affected by multiple vulnerabilities in the following components :

 - AppleMobileFileIntegrity (CVE-2016-4698)
 - Assets (CVE-2016-4741)
 - Audio (CVE-2016-4702)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711, CVE-2016-4712)
 - FontParser (CVE-2016-4718)
 - GeoServices (CVE-2016-4719)
 - IDS - Connectivity (CVE-2016-4722)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - Keyboards (CVE-2016-4746)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxslt (CVE-2016-4738)
 - Mail (CVE-2016-4747)
 - Messages (CVE-2016-4740)
 - Printing UIKit (CVE-2016-4749)
 - S2 Camera (CVE-2016-4750)
 - Safari Reader (CVE-2016-4618)
 - Sandbox Profiles (CVE-2016-4620)
 - Security (CVE-2016-4753)
 - Springboard (CVE-2016-7759)
 - WebKit (CVE-2016-4728, CVE-2016-4758, CVE-2016-4611, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4759, CVE-2016-4762, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4760, CVE-2016-4733, CVE-2016-4765, CVE-2016-4763)

Versions of iTunes prior to 12.5.1 are affected by multiple vulnerabilities in the Webkit component.

Versions of Safari prior to 10 are affected by multiple vulnerabilities in the following components :

 - Reader (CVE-2016-4618) 
 - Tabs (CVE-2016-4751) 
 - Webkit (CVE-2016-4611, CVE-2016-4728, CVE-2016-4729, CVE-2016-4730, CVE-2016-4731, CVE-2016-4733, CVE-2016-4734, CVE-2016-4735, CVE-2016-4737, CVE-2016-4758, CVE-2016-4759, CVE-2016-4760, CVE-2016-4762, CVE-2016-4763, CVE-2016-4765, CVE-2016-4766, CVE-2016-4767, CVE-2016-4768, CVE-2016-4769)

ID	Name	Product	Family	Published	Updated	Severity
94971	Apple iTunes < 12.5.1 Multiple Vulnerabilities (uncredentialed Check)	Nessus	Peer-To-Peer File Sharing	11/18/2016	11/14/2019	high
93721	Mac OS X : Apple Safari < 10.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	9/26/2016	7/14/2018	high
94914	Apple iTunes < 12.5.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	11/16/2016	11/14/2019	high
9619	Apple iOS < 10.0 Multiple Vulnerabilities	Nessus Network Monitor	Mobile Devices	10/3/2016	3/6/2019	critical
9709	iTunes < 12.5.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	10/25/2016	3/6/2019	high
9708	Safari < 10 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	10/21/2016	3/6/2019	medium

Detections

Analytics

Plugins Search

high

high

high

critical

high

medium