Lucene search

[email protected]CVE-2004-1314

HistoryJan 10, 2005 - 5:00 a.m.

CVE-2004-1314

2005-01-1005:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

safari

remote attackers

spoofing

web sites

window injection

vulnerability

cve-2004-1314

nvd

6.7 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

86.6%

JSON

Safari 1.x allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the “window injection” vulnerability, a different vulnerability than CVE-2004-1122.

CPENameOperatorVersion
apple:safariapple safarieq1.2.2
apple:safariapple safarieq1.0
apple:safariapple safarieq1.2.1
apple:safariapple safarieq1.1
apple:safariapple safarieq1.2
apple:safariapple safarieqbeta2
apple:safariapple safarieq1.2.3

CPE	Name	Operator	Version
apple:safari	apple safari	eq	1.2.2
apple:safari	apple safari	eq	1.0
apple:safari	apple safari	eq	1.2.1
apple:safari	apple safari	eq	1.1
apple:safari	apple safari	eq	1.2
apple:safari	apple safari	eq	beta2
apple:safari	apple safari	eq	1.2.3

References

lists.apple.com/archives/security-announce/2005/Jan/msg00001.html

secunia.com/advisories/13252/

secunia.com/multiple_browsers_window_injection_vulnerability_test/

secunia.com/secunia_research/2004-13/advisory/

exchange.xforce.ibmcloud.com/vulnerabilities/18397

Social References

6.7 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.015 Low

EPSS

Percentile

86.6%

JSON

Related for CVE-2004-1314

cve2 nessus3