The vulnerability in browser extensions for Safari on operating systems macOS, iOS, iPadOS, and visionOS allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Safari browser extensions on macOS, iOS, iPadOS, and VisionOS operating systems is related to improper storage of permissions. Exploiting this vulnerability can allow attackers to compromise the confidentiality, integrity, and accessibility of protected information...

Mac OS X Safari file:// Redirection Sandbox Escape

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mac OS X Safari file:// Redirection Sandbox Escape', 'Description' = %q Versions of Safari before 8.0.6, 7.1.6, and 6.2.6 are vulnerable to a...

Mac OS X < 10.11 Multiple Vulnerabilities

Binary data 8982.prm...

CVE-2015-5780

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

Design/Logic Flaw

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

CVE-2015-5780

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

CVE-2015-5780

The CVE-2015-5780 entry concerns Safari before v9, where the Safari Extensions implementation allowed a validated, user-installed extension to be replaced on disk without prompting the user. Root cause: extension replacement validation/UX flow did not require user confirmation. Impact stated in s...

PT-2015-2265

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 9 Description The issue is related to the Safari Extensions implementation, which does not require user confirmation before replacing an installed extension. This has an unspecified impact and attack vectors. The...

CVE-2015-5780: Improper Input Validation

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors...

Mac OS X : Apple Safari < 9.0 Multiple Vulnerabilities

The version of Apple Safari installed on the remote Mac OS X host is prior to 9.0. It is, therefore, affected by multiple vulnerabilities in the following components : - Safari - Safari Downloads - Safari Extensions - Safari Safe Browsing - WebKit - WebKit CSS - WebKit JavaScript Bindings - WebKi...

Mac OS X Safari file:// Redirection Sandbox Escape

Versions of Safari before 8.0.6, 7.1.6, and 6.2.6 are vulnerable to a "state management issue" that allows a browser window to be navigated to a file:// URL. By dropping and loading a malicious .webarchive file, an attacker can read arbitrary files, inject cross-domain Javascript, and silently...

Directory traversal

Directory traversal vulnerability in Apple Safari before 5.1.1 allows remote attackers to execute arbitrary JavaScript code, in a Safari Extensions context, via a crafted safari-extension: URL...

CVE-2011-3229

Directory traversal vulnerability in Apple Safari before 5.1.1 allows remote attackers to execute arbitrary JavaScript code, in a Safari Extensions context, via a crafted safari-extension: URL...

PT-2011-4322

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 5.1.1 Description A directory traversal issue allows remote attackers to execute arbitrary JavaScript code in a Safari Extensions context via a crafted safari-extension: URL. Recommendations For versions prior to...