CVE-2007-3758

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting XSS attacks...

CVE-2007-4671

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages...

CVE-2007-3758

CVE-2007-3758 affects Safari on Apple iPhone 1.1.1 and Safari 3 prior to Beta Update 3.0.4, on Windows, and Mac OS X 10.4–10.4.10. Root cause: JavaScript window properties can be set across domain boundaries, enabling cross-site scripting (XSS). Impact as described: remote XSS vector. Remediation...

CVE-2007-3759

CVE-2007-3759 affects Apple iPhone Safari 1.1.1. When instructed to disable JavaScript, Safari does not fully disable it until the browser is restarted, leaving potential exposure to scripts after the user’s action. The issue is tied to the Safari JS disable state not taking effect immediately. P...

CVE-2007-3760

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags...

CVE-2007-3754

Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a man-in-the-middle MITM attack...

CVE-2007-3755

Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a "tel:" link, which does not prompt the user before dialing the number...

Code injection

Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user to make calls to arbitrary telephone numbers via a "tel:" link, which does not prompt the user before dialing the number...

CVE-2007-3756

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to obtain sensitive information via a crafted web page that identifies the URL of the parent window, even when the parent window is in a different domain...

Code injection

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to obtain sensitive information via a crafted web page that identifies the URL of the parent window, even when the parent window is in a different domain...

Code injection

Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that will be dialed...

CVE-2007-3753

Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service application termination and execute arbitrary code via crafted Service Discovery Protocol SDP packets, related to insufficient input validation...

Input validation

Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service application termination and execute arbitrary code via crafted Service Discovery Protocol SDP packets, related to insufficient input validation...

CVE-2007-3757

Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that will be dialed...

CVE-2007-3753

Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to cause a denial of service application termination and execute arbitrary code via crafted Service Discovery Protocol SDP packets, related to insufficient input validation...

CVE-2007-3754

CVE-2007-3754 : The Apple iPhone Mail client in iPhone OS 1.1.1 does not warn users when the mail server identity changes or is untrusted while using SSL, which could enable a remote attacker to perform a MITM, stealing credentials and reading email. The available connected sources confirm the af...

CVE-2007-3757

Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that will be dialed...

CVE-2007-3754

Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server changes or is not trusted, which might allow remote attackers to steal credentials and read email via a man-in-the-middle MITM attack...

CVE-2007-3755

The CVE-2007-3755 issue affects the Apple iPhone’s Mail client (around v1.1.1) where embedded tel: links can trigger phone calls without user confirmation. The root cause is processing tel: hyperlinks in the Mail client that allows remote user-assisted attackers to cause the device to dial arbitr...

CVE-2007-3756

CVE-2007-3756 affects Safari in Apple iPhone 1.1.1 and Safari 3 prior to Beta Update 3.0.4 on Windows and macOS 10.4–10.4.10. A crafted web page can cause cross-domain access to reveal the URL of the parent window, enabling information disclosure. Affected components: Safari web browser on iPhone...