Safari Security Vulnerabilities and Issues — Page 13 of Safari CVE List

Lucene search

AppleSafari

1536 matches found

CVE•added 2017/04/02 1:59 a.m.•74 views

CVE-2017-2465

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and applicati...

8.8CVSS8AI score0.00986EPSS

CVE•added 2017/07/20 4:29 p.m.•74 views

CVE-2017-7012

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute...

8.8CVSS8AI score0.00707EPSS

CVE•added 2017/07/20 4:29 p.m.•74 views

CVE-2017-7020

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote at...

8.8CVSS8.1AI score0.00513EPSS

CVE•added 2017/07/20 4:29 p.m.•74 views

CVE-2017-7023

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. watchOS before 3.2.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or c...

9.3CVSS8.1AI score0.00472EPSS

CVE•added 2017/07/20 4:29 p.m.•74 views

CVE-2017-7042

An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. iCloud before 6.2.2 on Windows is affected. iTunes before 12.6.2 on Windows is affected. tvOS before 10.2.2 is affected. The issue involves the "WebKit" component. It allows remote at...

9.3CVSS8.1AI score0.1308EPSS

CVE•added 2022/12/15 7:15 p.m.•74 views

CVE-2022-32833

An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16. An unauthorized user may be able to access browsing history.

5.3CVSS6.2AI score0.00196EPSS

CVE•added 2024/07/29 11:15 p.m.•74 views

CVE-2024-40794

This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14.6, iOS 17.6 and iPadOS 17.6, Safari 17.6. Private Browsing tabs may be accessed without authentication.

5.3CVSS6AI score0.00092EPSS

CVE•added 2010/09/24 7:0 p.m.•73 views

CVE-2010-1823

Use-after-free vulnerability in WebKit before r65958, as used in Google Chrome before 6.0.472.59, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger use of document APIs such as document.close during parsing, as demonstrated by a ...

9.3CVSS9AI score0.02537EPSS

CVE•added 2011/03/01 11:0 p.m.•73 views

CVE-2011-1114

Google Chrome before 9.0.597.107 does not properly handle tables, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."

7.5CVSS8.7AI score0.02823EPSS

CVE•added 2012/05/01 10:12 a.m.•73 views

CVE-2012-1521

Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

6.8CVSS7AI score0.07354EPSS

CVE•added 2015/08/16 11:59 p.m.•73 views

CVE-2015-3741

WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVE...

6.8CVSS8.5AI score0.00998EPSS

CVE•added 2017/02/20 8:59 a.m.•73 views

CVE-2016-7587

An issue was discovered in certain Apple products. iOS before 10.2 is affected. Safari before 10.0.2 is affected. iCloud before 6.1 is affected. iTunes before 12.5.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of ser...

8.8CVSS8AI score0.0068EPSS

CVE•added 2017/11/13 3:29 a.m.•73 views

CVE-2017-13783

An issue was discovered in certain Apple products. iOS before 11.1 is affected. Safari before 11.0.1 is affected. iCloud before 7.1 on Windows is affected. iTunes before 12.7.1 on Windows is affected. tvOS before 11.1 is affected. The issue involves the "WebKit" component. It allows remote attacker...

8.8CVSS7.7AI score0.21364EPSS

CVE•added 2017/11/13 3:29 a.m.•73 views

CVE-2017-13784

8.8CVSS7.7AI score0.21364EPSS

CVE•added 2017/11/13 3:29 a.m.•73 views

CVE-2017-13788

8.8CVSS7.7AI score0.01056EPSS

CVE•added 2017/05/22 5:29 a.m.•73 views

CVE-2017-2508

An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with container nodes.

6.1CVSS5.8AI score0.0114EPSS

CVE•added 2017/07/20 4:29 p.m.•73 views

CVE-2017-7022

9.3CVSS8.1AI score0.00472EPSS

CVE•added 2009/06/10 6:0 p.m.•72 views

CVE-2009-1709

Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG ...

9.3CVSS8.8AI score0.08085EPSS

CVE•added 2010/02/18 6:0 p.m.•72 views

CVE-2010-0651

WebKit before r52784, as used in Google Chrome before 4.0.249.78 and Apple Safari before 4.0.5, permits cross-origin loading of CSS stylesheets even when the stylesheet download has an incorrect MIME type and the stylesheet document is malformed, which allows remote attackers to obtain sensitive in...

4.3CVSS7.3AI score0.02258EPSS

CVE•added 2011/02/10 7:0 p.m.•72 views

CVE-2011-0981

Google Chrome before 9.0.597.94 does not properly perform event handling for animations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

7.5CVSS8.8AI score0.02239EPSS

CVE•added 2011/03/25 7:55 p.m.•72 views

CVE-2011-1293

Use-after-free vulnerability in the HTMLCollection implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

7.5CVSS8.6AI score0.01451EPSS

CVE•added 2015/03/18 10:59 p.m.•72 views

CVE-2015-1071

WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03...

6.8CVSS8.8AI score0.00805EPSS

CVE•added 2015/09/18 10:59 a.m.•72 views

CVE-2015-5800

WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-S...

6.8CVSS8.8AI score0.01538EPSS

CVE•added 2015/09/18 10:59 a.m.•72 views

CVE-2015-5819

6.8CVSS8.8AI score0.01538EPSS

CVE•added 2017/02/20 8:59 a.m.•72 views

CVE-2016-7656

8.8CVSS8.1AI score0.00728EPSS

CVE•added 2017/04/02 1:59 a.m.•72 views

CVE-2017-2459

8.8CVSS8AI score0.04294EPSS

CVE•added 2011/03/11 2:1 a.m.•71 views

CVE-2011-1203

Google Chrome before 10.0.648.127 does not properly handle SVG cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."

7.5CVSS8.7AI score0.02103EPSS

CVE•added 2012/03/05 7:55 p.m.•71 views

CVE-2011-3038

Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to multi-column handling.

6.8CVSS6.9AI score0.01173EPSS

CVE•added 2012/03/05 7:55 p.m.•71 views

CVE-2011-3044

Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG animation elements.

6.8CVSS6.9AI score0.02363EPSS

CVE•added 2012/03/22 4:55 p.m.•71 views

CVE-2011-3056

Google Chrome before 17.0.963.83 allows remote attackers to bypass the Same Origin Policy via vectors involving a "magic iframe."

6.8CVSS6AI score0.00892EPSS

CVE•added 2014/03/26 2:55 p.m.•71 views

CVE-2014-1300

Unspecified vulnerability in Apple Safari 7.0.2 on OS X allows remote attackers to execute arbitrary code with root privileges via unknown vectors, as demonstrated by Google during a Pwn4Fun competition at CanSecWest 2014.

10CVSS7.3AI score0.08527EPSS

CVE•added 2015/05/08 12:59 a.m.•71 views

CVE-2015-1153

WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1154.

6.8CVSS8.8AI score0.01171EPSS

CVE•added 2016/09/25 10:59 a.m.•71 views

CVE-2016-4730

WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4611, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735.

9.3CVSS8.3AI score0.08398EPSS

CVE•added 2017/02/20 8:59 a.m.•71 views

CVE-2016-7645

8.8CVSS8.1AI score0.00728EPSS

CVE•added 2017/11/13 3:29 a.m.•71 views

CVE-2017-13793

8.8CVSS8.7AI score0.01056EPSS

CVE•added 2019/04/03 6:29 p.m.•71 views

CVE-2018-4311

The issue was addressed by removing origin information. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

8.1CVSS7.6AI score0.00443EPSS

CVE•added 2025/05/29 10:15 p.m.•71 views

CVE-2025-30466

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, visionOS 2.4, macOS Sequoia 15.4. A website may be able to bypass Same Origin Policy.

9.8CVSS5.8AI score0.00019EPSS

CVE•added 2010/06/11 6:0 p.m.•70 views

CVE-2010-1395

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to inject arbitrary web script or HTML via vectors involving DOM constructor objects, related to a "scope management issu...

4.3CVSS7AI score0.01195EPSS

CVE•added 2011/08/29 3:55 p.m.•70 views

CVE-2011-2823

Use-after-free vulnerability in Google Chrome before 13.0.782.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a line box.

7.5CVSS7AI score0.0229EPSS

CVE•added 2012/03/09 12:55 a.m.•70 views

CVE-2011-3046

The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.

10CVSS6.3AI score0.04464EPSS

CVE•added 2013/06/05 2:39 p.m.•70 views

CVE-2013-1009

WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2013-1023.

6.8CVSS7.8AI score0.00665EPSS

CVE•added 2013/09/19 10:27 a.m.•70 views

CVE-2013-1041

WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.

6.8CVSS7.8AI score0.02313EPSS

CVE•added 2017/02/20 8:59 a.m.•70 views

CVE-2016-4613

An issue was discovered in certain Apple products. Safari before 10.0.1 is affected. iCloud before 6.0.1 is affected. iTunes before 12.5.2 is affected. tvOS before 10.0.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive information via a crafted...

6.5CVSS6.1AI score0.0059EPSS

CVE•added 2020/02/03 6:15 p.m.•70 views

CVE-2016-4676

A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive information.

7.5CVSS6.7AI score0.01783EPSS

CVE•added 2017/02/20 8:59 a.m.•70 views

CVE-2016-7610

8.8CVSS8AI score0.00774EPSS

CVE•added 2017/02/20 8:59 a.m.•70 views

CVE-2016-7641

8.8CVSS8.1AI score0.00774EPSS

CVE•added 2018/04/03 6:29 a.m.•70 views

CVE-2017-2492

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the "JavaScriptCore" component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that triggers pr...

6.1CVSS5.7AI score0.00312EPSS

CVE•added 2019/04/03 6:29 p.m.•70 views

CVE-2018-4377

A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8.

6.1CVSS6AI score0.0054EPSS

CVE•added 2023/09/27 3:19 p.m.•70 views

CVE-2023-40417

A window management issue was addressed with improved state management. This issue is fixed in Safari 17, iOS 17 and iPadOS 17, watchOS 10, macOS Sonoma 14. Visiting a website that frames malicious content may lead to UI spoofing.

5.4CVSS5.8AI score0.00302EPSS

CVE•added 2009/07/09 5:30 p.m.•69 views

CVE-2009-1725

WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to exe...

9.3CVSS7.4AI score0.12201EPSS

Total number of security vulnerabilities1536