Apple iPhone蓝牙任意代码执行漏洞

BUGTRAQ ID: 25855 CVECAN ID: CVE-2007-3753 Apple iPhone是苹果最新发布的智能手机。 iPhone的蓝牙服务器中存在输入验证错误，远程攻击者可能利用此漏洞控制系统。 如果向启用了蓝牙功能的iPhone手机发送了特制的服务发现协议（SDP）报文的话，就可以触发这个漏洞，导致应用程序意外终止或执行任意指令。 Apple iPhone 1.0.1 Apple iPhone 1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.apple.com/itunes/download/iTunesSetup.e...

Apple iPhone Safari浏览器跨域URI泄露漏洞

BUGTRAQ ID: 25859 CVECAN ID: CVE-2007-3756 Apple iPhone是苹果最新发布的智能手机。 iPhone中内嵌的Safari浏览器在网页读取处理上存在漏洞，恶意网站可能利用此漏洞获取用户网络浏览相关的信息。 iPhone中内嵌的Safari浏览器允许网页读取当前在父窗口中所浏览的URL。如果用户受骗访问了恶意网页的话，攻击者就可以获得非相关页面的URL。 Apple iPhone 1.0.1 Apple iPhone 1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Apple iPhone Mail非授权tel:初始化漏洞

BUGTRAQ ID: 25862 CVECAN ID: CVE-2007-3755 Apple iPhone是苹果最新发布的智能手机。 iPhone中内嵌的Mail邮件客户端在处理邮件中内嵌的“tel:”链接时存在漏洞，可能导致无意地拨打电话。 iPhone中内嵌的Mail邮件客户端支持使用电话链接（tel:）拨打电话号码。如果用户受骗跟随了邮件消息中的电话链接的话，攻击者就可以导致iPhone未经用户确认便拨打电话。 Apple iPhone 1.0.1 Apple iPhone 1 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

JVN#79013771 Safari allows access from HTTP to HTTPS

Safari is a default web browser installed in Mac OS X and iPhone. Safari contains a vulnerability that allows a remote attacker to access web page contents protected by SSL/TLS from an HTTP page in the same domain. Impact A remote attacker could obtain or change the web page contents protected by...

Code injection

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages...

Open redirect

Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect...

Cross site scripting

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain...

CVE-2007-3760

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags...

Cross site scripting

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting XSS attacks...

CVE-2007-3759

Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect...

CVE-2007-4671

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages...

CVE-2007-3758

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting XSS attacks...

CVE-2007-3761

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain...

CVE-2007-3760

CVE-2007-3760 describes a cross-site scripting (XSS) vulnerability affecting Safari on Apple iPhone 1.1.1 and Safari 3 prior to Beta Update 3.0.4 on Windows and Mac OS X 10.4–10.4.10. The issue allows remote attackers to inject arbitrary web script or HTML via frame tags. The underlying cause is ...

CVE-2007-3758

CVE-2007-3758 affects Safari on Apple iPhone 1.1.1 and Safari 3 prior to Beta Update 3.0.4, on Windows, and Mac OS X 10.4–10.4.10. Root cause: JavaScript window properties can be set across domain boundaries, enabling cross-site scripting (XSS). Impact as described: remote XSS vector. Remediation...

CVE-2007-3761

Cross-site scripting XSS vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain...

CVE-2007-3759

Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect...

CVE-2007-3759

CVE-2007-3759 affects Apple iPhone Safari 1.1.1. When instructed to disable JavaScript, Safari does not fully disable it until the browser is restarted, leaving potential exposure to scripts after the user’s action. The issue is tied to the Safari JS disable state not taking effect immediately. P...

CVE-2007-3761

CVE-2007-3761 affects Safari on Apple iPhone 1.1.1 and is a Cross-site scripting (XSS) vulnerability. The issue arises from Javascript events being applied to a frame in another domain, enabling remote attackers to inject arbitrary web script or HTML. The public records show a MEDIUM severity (CV...

CVE-2007-4671

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages...