TI-2015-05001 Aliases CVE-2015-5910 GHSA-x3m7-6q3v-h9p5

IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is…

LOW 17CWE-200Published 2015-09-18 · Updated 2024-08-06

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Partial · None · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

IDE Xcode Server in Apple Xcode before 7.0 does not ensure that server traffic is encrypted, which allows remote attackers to obtain sensitive information by sniffing the network.

Why it matters now

EPSS 0.00753 55th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:apple:xcode::::::::	up to 6.4	Vulnerable	Apple

cpe:2.3:a:apple:xcode:*:*:*:*:*:*:*:* Versions up to 6.4 Vulnerable ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2015-5910
2026-10-03 Alias added: GHSA-x3m7-6q3v-h9p5

References

Patch 1

APPLE-SA-2015-09-16-2

Advisory 1

https://support.apple.com/HT205217

TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
TI-2025-30709 Git allows arbitrary code execution through broken config quoting KEVCVSS 3.1HIGH 8.1
TI-2004-02557 distcc 2.x, as used in XCode 1.5 and others, when not configured to restrict access to… CVSS 2.0HIGH 9.3
TI-2014-07619 Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x… CVSS 3.1CRITICAL 9.8
TI-2021-04400 malicious repositories can execute remote code while cloning CVSS 3.1HIGH 8.0
TI-2016-00666 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to… CVSS 3.1HIGH 7.5

See all 99 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences