Apple iPhone Mail远程信息泄露漏洞

BUGTRAQ ID: 25856 CVECAN ID: CVE-2007-3754 Apple iPhone是苹果最新发布的智能手机。 iPhone内嵌的Mail邮件客户端在处理SSL连接时存在漏洞，远程攻击者可能利用此漏洞获取用户的敏感信息。 如果将iPhone内嵌的Mail邮件客户端配置为对入站和出站连接使用SSL的话，即使邮件服务器的身份已经改变或不可信任，Mail也不会警告用户。能够拦截连接的攻击者可以扮演称为用户的邮件服务器，获得用户的邮件凭据或其他敏感信息。 Apple iPhone 1.0.1 Apple iPhone 1...

Apple iPhone Mail非授权tel:初始化漏洞

BUGTRAQ ID: 25862 CVECAN ID: CVE-2007-3755 Apple iPhone是苹果最新发布的智能手机。 iPhone中内嵌的Mail邮件客户端在处理邮件中内嵌的“tel:”链接时存在漏洞，可能导致无意地拨打电话。 iPhone中内嵌的Mail邮件客户端支持使用电话链接（tel:）拨打电话号码。如果用户受骗跟随了邮件消息中的电话链接的话，攻击者就可以导致iPhone未经用户确认便拨打电话。 Apple iPhone 1.0.1 Apple iPhone 1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

JVN#79013771 Safari allows access from HTTP to HTTPS

Safari is a default web browser installed in Mac OS X and iPhone. Safari contains a vulnerability that allows a remote attacker to access web page contents protected by SSL/TLS from an HTTP page in the same domain. Impact A remote attacker could obtain or change the web page contents protected by...

Open redirect

Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect...

Code injection

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages...

CVE-2007-3758

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting XSS attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain...

Cross site scripting

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting XSS attacks...

CVE-2007-3760

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags...

CVE-2007-3761

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain...

CVE-2007-4671

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages...

CVE-2007-3759

Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect...

CVE-2007-3760

CVE-2007-3760 describes a cross-site scripting (XSS) vulnerability affecting Safari on Apple iPhone 1.1.1 and Safari 3 prior to Beta Update 3.0.4 on Windows and Mac OS X 10.4–10.4.10. The issue allows remote attackers to inject arbitrary web script or HTML via frame tags. The underlying cause is ...

CVE-2007-3759

Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect...

CVE-2007-3761

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain...

CVE-2007-3761

CVE-2007-3761 affects Safari on Apple iPhone 1.1.1 and is a Cross-site scripting (XSS) vulnerability. The issue arises from Javascript events being applied to a frame in another domain, enabling remote attackers to inject arbitrary web script or HTML. The public records show a MEDIUM severity (CV...

CVE-2007-3758

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting XSS attacks...

CVE-2007-3760

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags...

CVE-2007-4671

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages...

CVE-2007-3758

CVE-2007-3758 affects Safari on Apple iPhone 1.1.1 and Safari 3 prior to Beta Update 3.0.4, on Windows, and Mac OS X 10.4–10.4.10. Root cause: JavaScript window properties can be set across domain boundaries, enabling cross-site scripting (XSS). Impact as described: remote XSS vector. Remediation...