Lucene search

K

75 matches found

CVE
CVE
added 2009/01/08 7:30 p.m.47 views

CVE-2009-0070

Integer signedness error in Apple Safari allows remote attackers to read the contents of arbitrary memory locations, cause a denial of service (application crash), and probably have unspecified other impact via the array index of the arguments array in a JavaScript function, possibly a related issu...

9.3CVSS6.9AI score0.09793EPSS
CVE
CVE
added 2009/06/10 2:30 p.m.47 views

CVE-2009-1685

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML by overwriting the document.implementation property of (1) an embedded document o...

4.3CVSS6.3AI score0.00614EPSS
CVE
CVE
added 2009/06/15 7:30 p.m.47 views

CVE-2009-2058

Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attac...

6.8CVSS6.6AI score0.00265EPSS
CVE
CVE
added 2009/08/12 7:30 p.m.47 views

CVE-2009-2196

Unspecified vulnerability in Apple Safari 4 before 4.0.3 allows remote web servers to place an arbitrary web site in the Top Sites view, and possibly conduct phishing attacks, via unknown vectors.

5CVSS6.3AI score0.16946EPSS
CVE
CVE
added 2009/06/10 2:30 p.m.46 views

CVE-2009-1688

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to determining a security context through an approach that is...

4.3CVSS6.3AI score0.00614EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.46 views

CVE-2009-1715

Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges.

4.3CVSS6.6AI score0.02163EPSS
CVE
CVE
added 2009/06/15 7:30 p.m.46 views

CVE-2009-2062

Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.

6.8CVSS6.6AI score0.00299EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.45 views

CVE-2009-1696

WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 uses predictable random numbers in JavaScript applications, which makes it easier for remote web servers to track the behavior of a Safari user during a session.

5CVSS7.1AI score0.00953EPSS
CVE
CVE
added 2009/09/21 7:30 p.m.45 views

CVE-2009-3271

Apple Safari on iPhone OS 3.0.1 allows remote attackers to cause a denial of service (application crash) via a long tel: URL in the SRC attribute of an IFRAME element.

4.3CVSS6.1AI score0.02007EPSS
CVE
CVE
added 2009/12/03 5:30 p.m.45 views

CVE-2009-4186

Stack consumption vulnerability in Apple Safari 4.0.3 on Windows allows remote attackers to cause a denial of service (application crash) via a long URI value (aka url) in the Cascading Style Sheets (CSS) background property.

9.3CVSS6.1AI score0.04298EPSS
CVE
CVE
added 2009/06/10 2:30 p.m.44 views

CVE-2009-1689

Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving submission of a form to the about:blank URL, leading to sec...

4.3CVSS6.3AI score0.00614EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.42 views

CVE-2009-1716

CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files.

2.1CVSS5.1AI score0.00104EPSS
CVE
CVE
added 2009/02/13 12:30 a.m.41 views

CVE-2009-0137

Multiple unspecified vulnerabilities in Safari RSS in Apple Mac OS X 10.4.11 and 10.5.6, and Windows XP and Vista, allow remote attackers to execute arbitrary JavaScript in the local security zone via a crafted feed: URL, related to "input validation issues."

10CVSS7.3AI score0.0058EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.41 views

CVE-2009-1707

Race condition in the Reset Safari implementation in Apple Safari before 4.0 on Windows might allow local users to read stored web-site passwords via unspecified vectors.

1.2CVSS5.4AI score0.0007EPSS
CVE
CVE
added 2009/08/31 4:30 p.m.41 views

CVE-2009-3016

Apple Safari 4.0.3 does not properly block javascript: and data: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains a javascript: URI, (2) entering a javascript: U...

4.3CVSS5.3AI score0.00276EPSS
CVE
CVE
added 2009/08/12 7:30 p.m.40 views

CVE-2009-2200

WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document.

7.1CVSS7.5AI score0.00614EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.39 views

CVE-2009-1708

Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites, which allows remote attackers to open arbitrary local help files, and execute arbitrary code or obtain sensitive information, via a crafted call.

9.3CVSS7.1AI score0.03272EPSS
CVE
CVE
added 2009/06/15 7:30 p.m.39 views

CVE-2009-2066

Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, re...

6.8CVSS6.6AI score0.00299EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.38 views

CVE-2009-1704

CFNetwork in Apple Safari before 4.0 misinterprets downloaded image files as local HTML documents in unspecified circumstances, which allows remote attackers to execute arbitrary JavaScript code by placing it in an image file.

9.3CVSS6.8AI score0.02364EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.38 views

CVE-2009-1705

CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data.

9.3CVSS7.9AI score0.05154EPSS
CVE
CVE
added 2009/01/15 5:30 p.m.37 views

CVE-2009-0123

Unspecified vulnerability in Apple Safari on Mac OS X 10.5 and Windows allows remote attackers to read arbitrary files on a client machine via vectors related to the association of Safari with the (1) feed, (2) feeds, and (3) feedsearch URL types for RSS feeds. NOTE: as of 20090114, the only disclo...

7.1CVSS6.3AI score0.00529EPSS
CVE
CVE
added 2009/06/10 6:0 p.m.37 views

CVE-2009-1706

The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users via a cookie.

5CVSS6.2AI score0.00515EPSS
CVE
CVE
added 2009/03/24 2:30 p.m.36 views

CVE-2009-1060

Unspecified vulnerability in Apple Safari on Mac OS X 10.5.6 allows remote attackers to execute arbitrary code via unknown vectors triggered by clicking on a link, as demonstrated by Charlie Miller during a PWN2OWN competition at CanSecWest 2009.

9.3CVSS7.4AI score0.13958EPSS
CVE
CVE
added 2009/06/10 2:30 p.m.35 views

CVE-2009-1682

Apple Safari before 4.0 does not properly check for revoked Extended Validation (EV) certificates, which makes it easier for remote attackers to trick a user into accepting an invalid certificate.

4.3CVSS6.8AI score0.00387EPSS
CVE
CVE
added 2009/05/11 3:30 p.m.34 views

CVE-2009-1600

Apple Safari executes DOM calls in response to a javascript: URI in the target attribute of a submit element within a form contained in an inline PDF file, which might allow remote attackers to bypass intended Adobe Acrobat JavaScript restrictions on accessing the document object, as demonstrated b...

9.3CVSS6.3AI score0.00242EPSS
Total number of security vulnerabilities75