CVE-2013-1003

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-399

Affected software

No affected versions have been published.

Timeline

Published
May 20, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-100307.5A vulnerability, which was classified as problematic, has been found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this issueCVE-2013-100317.5Plack-Middleware-Session versions before 0.17 may be vulnerable to HMAC comparison timing attacksCVE-2013-100328.8An authenticated remote code execution vulnerability exists in GetSimpleCMS version 3.2.1. The application’s upload.php endpoint allows authCVE-2013-100339.3An unauthenticated SQL injection vulnerability exists in Kimai version 0.9.2.x via the db_restore.php endpoint. The flaw allows attackers toCVE-2013-100349.3An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2. The uploadImage.asp endpoint allows unauthentiCVE-2013-100358.7A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated usCVE-2013-100368.4A stack-based buffer overflow vulnerability exists in Beetel Connection Manager version PCW_BTLINDV1.0.0B04 when parsing the UserName parameCVE-2013-100379.3An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script. The parameters cpusername, cCVE-2013-100389.3An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fCVE-2013-100398.7A command injection vulnerability exists in GestioIP 3.0 commit ac67be and earlier in ip_checkhost.cgi. Crafted input to the 'ip' parameter CVE-2013-10049.3WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (meCVE-2013-100409.8ClipBucket version 2.6 and earlier contains a critical vulnerability in the ofc_upload_image.php script located at /admin_area/charts/ofc-li
CVE-2013-1003: Critical severity, CVSS 9.3 | Vulnix