16465 matches found
Multiple Apple Products WebKit Component Denial of Service Vulnerability
Apple iOS, Safari, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems; and tvOS is an operating system for smart TVs. webKit is an open source web...
Multiple Apple Products WebKit Security Bypass Vulnerability
Apple iOS, Safari, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems; and tvOS is an operating system for smart TVs. webKit is an open source web...
Multiple Apple Products WebKit Security Bypass Vulnerability
Apple iOS, Safari, and tvOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser that comes with Mac OS X and iOS operating systems; and tvOS is an operating system for smart TVs. webKit is an open source web...
Apple WebKit 10.0.2(12602.3.12.0.1) - disconnectSubframes Universal Cross-Site Scripting Exploit
Exploit for multiple platform in category web applications frameOwners; if policy == RootAndDescendants if isroot frameOwners.appenddowncastroot; collectFrameOwnersframeOwners, root; // Must disable frame loading in the subtree so an unload handler cannot // insert more frames and create loaded...
WebKit: ComposedTreeIterator::traverseNextInShadowTree use-after-free（CVE-2017-2466）
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC: function go d.open = false; d.innerHTML = "foo"; d.open = true; foo ASan log: ==570==ERROR:...
Apple WebKit - ComposedTreeIterator::traverseNextInShadowTree Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function go d.open = false; d.innerHTML = "foo"; d.open = true; foo !-- ================================================================= ASan log: ================================================================= ==570==ERROR: AddressSanitizer:...
Apple Webkit - Universal Cross-Site Scripting by Accessing a Named Property from an Unloaded Window
Exploit for multiple platform in category web applications document auto& htmlDocument = downcastdocument; auto atomicPropertyName = propertyName.publicName; if atomicPropertyName && htmlDocument.hasWindowNamedItematomicPropertyName JSValue namedItem; if...
WebKit: Negative-size memmove in HTMLFormElement (CVE-2017-2459)
There is a negative-size memmove security vulnerability in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC has also been observed to crash Safari 10.0.2 on Mac. PoC Note: It might take a couple of refreshes to trigger the bug: function go var iframe =...
WebKit: HTMLInputElement use-after-free (CVE-2017-2454)
There is a use-after-free security vulnerability related to how the HTMLInputElement is handled in WebKit. The vulnerability was confirmed on a nightly build of WebKit. The PoC also crashes Safari 10.0.2 on Mac. PoC: function eventhandler1 input.type = "foo"; function eventhandler2...
WebKit: table use-after-free（CVE-2017-2471）
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on a nightly version of WebKit. The PoC has also been observed to crash Safari 10.0.3 on Mac. PoC: -webkit-border-image: urlfoo 1 5 1 63 repeat; -webkit-flow-into: foo function eventhandler var a;...
Apple WebKit - FormSubmission::create Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function go object.name = "foo"; input.autofocus = true; output.appendChildinput; form.submit; function eventhandler forvar i=0;i a !-- ================================================================= Preliminary analysis: The bug is in...
Apple WebKit - RenderLayer Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function go div.style.setProperty"-webkit-flow-into", "foo"; document.execCommand"fontSize", false, 6; window.requestAnimationFramecb; h1.attachShadowmode: "open"; h1.replaceWith"foo"; function cb var a; //trigger garbage collector forvar i=0;i...
Apple WebKit - Negative-Size memmove in HTMLFormElement Exploit
Exploit for multiple platform in category dos / poc function go var iframe = document.getElementById"iframe"; var iframeWindow = window0; var toInsert = div; var iframeBody = iframeWindow.document.body; iframeBody.beforedocument.body; iframe.aftertoInsert; aaaaaaaa !--...
Apple WebKit - table Use-After-Free Exploit
Exploit for multiple platform in category dos / poc -webkit-border-image: urlfoo 1 5 1 63 repeat; -webkit-flow-into: foo function eventhandler var a; document.execCommand"selectAll", false; output.slot = "foo"; table.deleteCaption; //trigger garbage collector forvar i=0;i foo !--...
Apple WebKit 10.0.2 - HTMLInputElement Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function eventhandler1 input.type = "foo"; function eventhandler2 input.selectionStart = 25; !-- ================================================================= ASAN log from WebKit nightly on Mac:...
Apple WebKit 10.0.2(12602.3.12.0.1, r210800) - constructJSReadableStreamDefaultReader Type Confusion
Exploit for multiple platform in category web applications exec.argument0; if !stream return throwArgumentTypeErrorexec, scope, 0, "stream", "ReadableStreamReader", nullptr, "ReadableStream"; JSValue jsFunction = stream-get&exec, Identifier::fromString&exec, "getReader"; let rs = new...
WebKit: WebCore::toJS use-after-free（CVE-2017-2476）
There is a use-after-free security vulnerability in WebKit. The vulnerability was confirmed on ASan build of WebKit nightly. PoC: function freememory var a; forvar i=0;i ASan log: ==25184==ERROR: AddressSanitizer: heap-use-after-free on address 0x61a000076e80 at pc 0x000115bea4e0 bp 0x7fff52cef2e...
WebKit Denial of Service Vulnerability (CNVD-2017-05499)
WebKit is KDE, Apple Apple, Google Google and other companies to develop a set of open source Web browser engine , currently used by Apple Safari and Google Chrome and other browsers . WebKit suffers from a denial of service vulnerability. A remote attacker could exploit the vulnerability to caus...
Apple WebKit - WebCore::toJS Use-After-Free Exploit
Exploit for multiple platform in category dos / poc function freememory var a; forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==25184==ERROR: AddressSanitizer: heap-use-after-free on...