This page lists publicly disclosed CVE vulnerabilities affecting apple xcode (linked via NVD CPE). Each row includes severity scores, summaries, and publication dates to help identify and analyze security issues.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2017-7137 | An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file. | [email protected] | 7.8 | 1.52% | 2017-10-22 | 2026-06-16 |
| CVE-2017-7136 | An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file. | [email protected] | 7.8 | 1.52% | 2017-10-22 | 2026-06-16 |
| CVE-2017-7135 | An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file. | [email protected] | 7.8 | 1.52% | 2017-10-22 | 2026-06-16 |
| CVE-2017-7134 | An issue was discovered in certain Apple products. Xcode before 9 is affected. The issue involves the "ld64" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Mach-O file. | [email protected] | 7.8 | 1.52% | 2017-10-22 | 2026-06-16 |
| CVE-2017-7529 | Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. | [email protected] | 7.5 | 62.60% | 2017-07-13 | 2026-06-16 |
| CVE-2016-4705 | otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4704. | [email protected] | 7.8 | 0.34% | 2016-09-18 | 2026-06-16 |
| CVE-2016-4704 | otool in Apple Xcode before 8 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors, a different vulnerability than CVE-2016-4705. | [email protected] | 7.8 | 0.31% | 2016-09-18 | 2026-06-16 |
| CVE-2016-1765 | otool in Apple Xcode before 7.3 allows local users to gain privileges or cause a denial of service (memory corruption and application crash) via unspecified vectors. | [email protected] | 7.8 | 0.33% | 2016-03-23 | 2026-06-16 |
| CVE-2016-0747 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 does not properly limit CNAME resolution, which allows remote attackers to cause a denial of service (worker process resource consumption) via vectors related to arbitrary name resolution. | [email protected] | 5.3 | 8.43% | 2016-02-15 | 2026-06-16 |
| CVE-2016-0746 | Use-after-free vulnerability in the resolver in nginx 0.6.18 through 1.8.0 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (worker process crash) or possibly have unspecified other impact via a crafted DNS response related to CNAME response processing. | [email protected] | 9.8 | 8.62% | 2016-02-15 | 2026-06-16 |
| CVE-2016-0742 | The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response. | [email protected] | 7.5 | 81.96% | 2016-02-15 | 2026-06-16 |
| CVE-2015-7057 | otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7049. | [email protected] | 4.6 | 0.30% | 2015-12-11 | 2026-06-16 |
| CVE-2015-7056 | IDE SCM in Apple Xcode before 7.2 does not recognize .gitignore files, which allows remote attackers to obtain sensitive information in opportunistic circumstances by leveraging the presence of a file matching an ignore pattern. | [email protected] | 5.0 | 1.29% | 2015-12-11 | 2026-06-16 |
| CVE-2015-7049 | otools in Apple Xcode before 7.2 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted mach-o file, a different vulnerability than CVE-2015-7057. | [email protected] | 4.6 | 0.30% | 2015-12-11 | 2026-06-16 |
| CVE-2015-7030 | The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors. | [email protected] | 7.5 | 1.62% | 2015-10-23 | 2026-06-16 |
| CVE-2015-5910 | IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network. | [email protected] | 3.3 | 0.75% | 2015-09-18 | 2026-06-16 |
| CVE-2015-5909 | IDE Xcode Server in Apple Xcode before 7.0 does not properly restrict access to repository e-mail lists, which allows remote attackers to obtain potentially sensitive build information in opportunistic circumstances by leveraging incorrect notification delivery. | [email protected] | 5.0 | 1.92% | 2015-09-18 | 2026-06-16 |
| CVE-2015-3187 | The svn_repos_trace_node_locations function in Apache Subversion before 1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used, allows remote authenticated users to obtain sensitive path information by reading the history of a node that has been moved from a hidden path. | [email protected] | 4.0 | 6.46% | 2015-08-12 | 2026-06-16 |
| CVE-2015-3184 | mod_authz_svn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name. | [email protected] | 5.0 | 10.61% | 2015-08-12 | 2026-06-16 |
| CVE-2015-3185 | The ap_some_auth_required function in server/request.c in the Apache HTTP Server 2.4.x before 2.4.14 does not consider that a Require directive may be associated with an authorization setting rather than an authentication setting, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging the presence of a module that relies on the 2.2 API behavior. | [email protected] | 4.3 | 18.80% | 2015-07-20 | 2026-06-16 |