CVE-2009-1697

CVE-2009-1697 is a CRLF injection vulnerability in WebKit that can allow remote attackers to inject HTTP headers and bypass the Same Origin Policy via a crafted HTML document, related to cross-site scripting exploits using XMLHttpRequest without a Host header. Affected products include Apple Safa...

CVE-2009-1701

CVE-2009-1701 is a use-after-free in WebKit's JavaScript DOM handling, affecting Apple Safari before 4.0 (and related iPhone OS versions). Exploitation involves destroying a document.body with an XML container and dir attributes, enabling remote code execution or a denial of service through memor...

CVE-2009-1695

CVE-2009-1695 is a cross-site scripting (XSS) vulnerability in WebKit used by Apple Safari (pre-4.0) that allows remote attackers to inject arbitrary web script or HTML. The issue arises from vectors involving access to frame contents after a page transition, enabling potential execution of malic...

CVE-2009-1696

CVE-2009-1696 affects WebKit/Apple Safari and related iOS components, where Safari before 4.0 (including iPhone OS 1.0–2.2.1 and iPod touch 1.1–2.2.1) used predictable JavaScript RNG. This predictability could allow remote servers to track a Safari user’s session behavior. Connected documents con...

CVE-2009-1702

CVE-2009-1702 is an XSS vulnerability in WebKit used by Apple Safari and the iPhone OS Safari implementation, allowing remote attackers to inject arbitrary web script or HTML via improper handling of Location and History objects. Affected products include Safari

CVE-2009-1701

Removed by vendor...

CVE-2009-1689

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving submission of a form to the about:blank URL, leading to...

CVE-2009-1684

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via an event handler that triggers script execution in the context of the next...

Cross site scripting

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read images from arbitrary web sites via vectors involving a CANVAS element and redirection, related to a "cross-site...

Cross site scripting

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving submission of a form to the about:blank URL, leading to...

Cross site scripting

Cross-site scripting XSS vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML by overwriting the document.implementation property of 1 an embedded document or ...

CVE-2009-1694

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read images from arbitrary web sites via vectors involving a CANVAS element and redirection, related to a "cross-site...

CVE-2009-1681

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a craft...

CVE-2009-1693

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to read images from arbitrary web sites via a CANVAS element with an SVG image, related to a "cross-site image capture issue."...

CVE-2009-1693

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to read images from arbitrary web sites via a CANVAS element with an SVG image, related to a "cross-site image capture issue."...

CVE-2009-1685

CVE-2009-1685 is a documented XSS vulnerability in WebKit used by Apple Safari prior to 4.0 and by iOS webviews (iPhone OS 1.0–2.2.1). The root cause, as described in authoritative sources, is that overwriting the document.implementation property of either an embedded document or a parent documen...

CVE-2009-1681

Summary: CVE-2009-1681 affects WebKit in Apple Safari (and iPhone OS variants) where loading third-party content into a subframe bypasses the Same Origin Policy, enabling clickjacking. The connected documents provide detailed CVE entries and advisories, notably Debian DSA-1950-1 and openVAS/Nessu...

CVE-2009-1690

CVE-2009-1690 is a use-after-free in WebKit affecting Safari (pre-4.0) and related WebKit-based products (iPhone OS 1.0–2.2.1, iPod touch 1.1–2.2.1, Google Chrome 1.0.154.53). The issue arises when a crafted HTML tag property causes child elements to be freed and later accessed during an HTML err...

CVE-2009-1690

Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service memory...

CVE-2009-1689

The CVE-2009-1689 entry concerns a Cross-site scripting (XSS) vulnerability in WebKit used by Apple Safari up to version 4.0, affecting iOS 1.0–2.2.1 and iPod touch equivalents. The issue allows remote attackers to inject arbitrary script or HTML via vectors involving submitting a form to about:b...