Safari Content-Disposition Handling Could Allow Cross-site Scripting

Executive Summary Microsoft is providing notification of the discovery and remediation of a vulnerability affecting Apple Safari software version 5.1.5 7534.55.3 for Windows and earlier. Microsoft discovered and disclosed the vulnerability under coordinated vulnerability disclosure to the affecte...

iDefense Security Advisory 10.12.11: Apple MobileSafari Attachment Viewing Cross Site Scripting Vulnerability

iDefense Security Advisory 10.12.11 http://labs.idefense.com/intelligence/vulnerabilities/ Oct 12, 2011 I. BACKGROUND MobileSafari is Apple's mobile we browser for iOS devices. For more information about MobileSafari, please the visit following website:...

CVE-2011-3426

CVE-2011-3426 is an XSS vulnerability in Safari for iOS prior to 5, caused by Safari’s handling of files with the HTTP Content-Disposition header value “attachment.” A crafted file can execute inline scripts when opened in Safari, enabling remote script execution. Public references (e.g., JVN/JVN...