Today's NIST CVE Issuance's For Vulns In Microsoft and Apple Products

Click on the underlined CVE for additional vuln specific info

CVE-2013-1451

Summary: Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, does not ensure that the SSL lock icon is consistent with the Address bar, which makes it easier for remote attackers to spoof web sites via a crafted HTML document that triggers many HTTPS requests to an arbitrary host, followed by an HTTPS request to a trusted host and then an HTTP request to an untrusted host, a related issue to CVE-2013-1450.

Published: 01/29/2013

CVSS Severity: 5.8 (MEDIUM)

CVE-2013-1450

Summary: Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, does not properly reuse TCP sessions to the proxy server, which allows remote attackers to obtain sensitive information intended for a specific host via a crafted HTML document that triggers many HTTPS requests and then triggers an HTTP request to that host, as demonstrated by reading a Cookie header, aka MSRC 12096gd.

Published: 01/29/2013

CVSS Severity: 4.3 (MEDIUM)

CVE-2013-0974

Summary: StoreKit in Apple iOS before 6.1 does not properly handle the disabling of JavaScript within the preferences configuration of Mobile Safari, which allows remote attackers to bypass intended access restrictions and execute JavaScript code via a web site with a Smart App Banner.

Published: 01/29/2013

CVSS Severity: 5.1 (MEDIUM)

CVE-2013-0968

Summary: WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.

Published: 01/29/2013

CVSS Severity: 6.8 (MEDIUM)

CVE-2013-0964

Summary: The kernel in Apple iOS before 6.1 and Apple TV before 5.2 does not properly validate copyin and copyout arguments, which allows local users to bypass intended pointer restrictions and access locations in the first kernel-memory page by specifying a length of less than one page.

Published: 01/29/2013

CVSS Severity: 4.1 (MEDIUM)

CVE-2013-0963

Summary: Identity Services in Apple iOS before 6.1 does not properly handle validation failures of AppleID certificates, which might allow physically proximate attackers to bypass authentication by leveraging an incorrect assignment of an empty string value to an AppleID.

Published: 01/29/2013

CVSS Severity: 2.1 (LOW)

CVE-2013-0962

Summary: Cross-site scripting (XSS) vulnerability in WebKit in Apple iOS before 6.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted content that is not properly handled during a copy-and-paste operation.

Published: 01/29/2013

CVSS Severity: 2.6 (LOW)

CVE-2013-0959

Published: 01/29/2013

CVSS Severity: 6.8 (MEDIUM)

CVE-2013-0958

Published: 01/29/2013

CVSS Severity: 6.8 (MEDIUM)

CVE-2013-0956

Published: 01/29/2013

CVSS Severity: 6.8 (MEDIUM)

CVE-2013-0955