The version of Apple iOS running on the mobile device is prior to 17.7.1. It is, therefore, affected by multiple vulnerabilities.

The version of Apple iOS running on the mobile device is prior to 18. It is, therefore, affected by multiple vulnerabilities.

The version of Apple Safari installed on the remote host is prior to 18.0. It is, therefore, affected by multiple vulnerabilities as referenced in the 121241 advisory.

  - This issue was addressed through improved state management. This issue is fixed in Safari 18, visionOS 2,     watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18, tvOS 18. Processing maliciously crafted web content     may lead to universal cross site scripting. (CVE-2024-40857)

  - The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a     malicious website may lead to address bar spoofing. (CVE-2024-40866)

  - A custom URL scheme handling issue was addressed with improved input validation. This issue is fixed in     Safari 18, iOS 17.7.1 and iPadOS 17.7.1, macOS Sequoia 15, watchOS 11, iOS 18 and iPadOS 18. Maliciously     crafted web content may violate iframe sandboxing policy. (CVE-2024-44155)

  - A cross-origin issue existed with iframe elements. This was addressed with improved tracking of security     origins. This issue is fixed in Safari 18, visionOS 2, watchOS 11, macOS Sequoia 15, iOS 18 and iPadOS 18,     tvOS 18. A malicious website may exfiltrate data cross-origin. (CVE-2024-44187)

  - An authentication issue was addressed with improved state management. This issue is fixed in iOS 18 and     iPadOS 18. Private Browsing tabs may be accessed without authentication. (CVE-2024-44202)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 15.x prior to the full release of 15.0. It is, therefore, affected by multiple vulnerabilities:

  - This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Sequoia     15. An app may be able to break out of its sandbox. (CVE-2024-44148)

  - Due to failure in validating the length provided by an attacker-crafted PPD PostScript document, CUPS and     libppd are susceptible to a heap-based buffer overflow and possibly code execution. This issue has been     fixed in CUPS version 2.4.7, released in September of 2023. (CVE-2023-4504)

  - Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline     data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a     heap-based buffer overflow vulnerability. This issue was resolved as of versions v3.2.2 and v3.1.12 of the     affected library. (CVE-2023-5841)

  - The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may     be able to cause a denial-of-service. (CVE-2024-23237)

  - A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. A     camera extension may be able to access the internet. (CVE-2024-27795)

Note that Nessus has not tested for these issues but has instead relied only on the operating system's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
209847	Apple iOS < 17.7.1 Multiple Vulnerabilities (121567)	Nessus	Mobile Devices	10/28/2024	2/12/2025	high
207288	Apple iOS < 18 Multiple Vulnerabilities (121250)	Nessus	Mobile Devices	9/16/2024	3/4/2025	critical
212177	Apple Safari 18.0 Multiple Vulnerabilities (121241)	Nessus	MacOS X Local Security Checks	12/9/2024	12/9/2024	medium
213517	macOS 15.x < 15.0 Multiple Vulnerabilities (121238)	Nessus	MacOS X Local Security Checks	1/7/2025	1/7/2025	critical

Detections

Analytics

Plugins Search

high

critical

medium

critical