Safari Security Vulnerabilities and Issues — Page 3 of Safari CVE List

Lucene search

AppleSafari

134 matches found

CVE•added 2015/03/18 10:59 p.m.•52 views

CVE-2015-1072

WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03...

6.8CVSS8.8AI score0.00787EPSS

CVE•added 2015/04/10 2:59 p.m.•52 views

CVE-2015-1124

WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerabi...

6.8CVSS8.9AI score0.00913EPSS

CVE•added 2015/08/16 11:59 p.m.•52 views

CVE-2015-3751

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, allows remote attackers to bypass a Content Security Policy protection mechanism by using a video control in conjunction with an IMG element within an OBJECT element.

5CVSS7.2AI score0.01553EPSS

CVE•added 2015/10/09 5:59 a.m.•52 views

CVE-2015-5780

The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

10CVSS6.2AI score0.00628EPSS

CVE•added 2015/09/18 10:59 a.m.•52 views

CVE-2015-5792

WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-S...

6.8CVSS7.8AI score0.01538EPSS

CVE•added 2015/10/23 9:59 p.m.•52 views

CVE-2015-7002

WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-S...

6.8CVSS8.9AI score0.01009EPSS

CVE•added 2015/12/11 11:59 a.m.•52 views

CVE-2015-7100

WebKit in Apple iOS before 9.2, Safari before 9.0.2, and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-7048, CVE-2015-7095, CVE-2015-7096, CVE-2...

6.8CVSS8.9AI score0.01093EPSS

CVE•added 2015/03/18 10:59 p.m.•51 views

CVE-2015-1080

6.8CVSS7.8AI score0.00913EPSS

CVE•added 2015/09/18 10:59 a.m.•51 views

CVE-2015-5820

WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.

4.3CVSS5.8AI score0.006EPSS

CVE•added 2015/12/11 11:59 a.m.•51 views

CVE-2015-7050

WebKit in Apple iOS before 9.2 and Safari before 9.0.2 misparses content extensions, which allows remote attackers to obtain sensitive browsing-history information via a crafted web site.

4.3CVSS5.3AI score0.00582EPSS

CVE•added 2015/05/08 12:59 a.m.•50 views

CVE-2015-1156

The page-loading implementation in WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, does not properly handle the rel attribute in an A element, which allows remote attackers to bypass the Same Origin Policy for a link's target, and spoof the user interface, via ...

4.3CVSS7.7AI score0.00627EPSS

CVE•added 2015/08/16 11:59 p.m.•50 views

CVE-2015-3730

WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVE...

6.8CVSS8.4AI score0.01081EPSS

CVE•added 2015/08/16 11:59 p.m.•50 views

CVE-2015-3733

6.8CVSS8.4AI score0.01643EPSS

CVE•added 2015/08/17 12:0 a.m.•50 views

CVE-2015-5748

The kernel in Apple OS X before 10.10.5 does not properly mount HFS volumes, which allows local users to cause a denial of service via a crafted volume.

2.1CVSS7.3AI score0.0008EPSS

CVE•added 2015/09/18 10:59 a.m.•50 views

CVE-2015-5791

WebKit, as used in JavaScriptCore in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-0...

6.8CVSS7.8AI score0.01538EPSS

CVE•added 2015/09/18 10:59 a.m.•50 views

CVE-2015-5803

6.8CVSS8.8AI score0.01538EPSS

CVE•added 2015/03/18 10:59 p.m.•49 views

CVE-2015-1068

6.8CVSS8.8AI score0.00853EPSS

CVE•added 2015/07/03 1:59 a.m.•49 views

CVE-2015-3660

Cross-site scripting (XSS) vulnerability in the PDF functionality in WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x before 8.0.7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL in embedded PDF content.

4.3CVSS6.6AI score0.0032EPSS

CVE•added 2015/08/16 11:59 p.m.•49 views

CVE-2015-3754

The private-browsing implementation in WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8 does not prevent caching of HTTP authentication credentials, which makes it easier for remote attackers to track users via a crafted web site.

4.3CVSS8.1AI score0.00505EPSS

CVE•added 2015/03/18 10:59 p.m.•48 views

CVE-2015-1073

6.8CVSS8.8AI score0.00787EPSS

CVE•added 2015/08/16 11:59 p.m.•48 views

CVE-2015-3753

WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a r...

5CVSS7.2AI score0.00621EPSS

CVE•added 2015/09/18 10:59 a.m.•48 views

CVE-2015-5798

WebKit, as used in Apple iTunes before 12.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-...

6.8CVSS7.5AI score0.00651EPSS

CVE•added 2015/09/18 10:59 a.m.•48 views

CVE-2015-5825

WebKit in Apple iOS before 9 does not properly restrict the availability of Performance API times, which allows remote attackers to obtain sensitive information about the browser history, mouse movement, or network traffic via crafted JavaScript code.

4.3CVSS7.3AI score0.006EPSS

CVE•added 2015/10/23 9:59 p.m.•48 views

CVE-2015-7014

6.8CVSS8.9AI score0.0117EPSS

CVE•added 2015/09/18 10:59 a.m.•47 views

CVE-2015-5764

The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5765 and CVE-2015-5767.

4.3CVSS5.9AI score0.00846EPSS

CVE•added 2015/09/18 10:59 a.m.•47 views

CVE-2015-5767

The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5765.

4.3CVSS5.9AI score0.00846EPSS

CVE•added 2015/12/11 12:0 p.m.•47 views

CVE-2015-7104

WebKit in Apple Safari before 9.0.2 and tvOS before 9.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

6.8CVSS8.8AI score0.01538EPSS

CVE•added 2015/03/18 10:59 p.m.•46 views

CVE-2015-1084

The user interface in WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, does not display URLs consistently, which makes it easier for remote attackers to conduct phishing attacks via a crafted URL.

5CVSS6AI score0.00434EPSS

CVE•added 2015/04/10 2:59 p.m.•46 views

CVE-2015-1129

Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 does not properly select X.509 client certificates, which makes it easier for remote attackers to track users via a crafted web site.

4.3CVSS6.1AI score0.00227EPSS

CVE•added 2015/08/16 11:59 p.m.•46 views

CVE-2015-3732

6.8CVSS8.5AI score0.01576EPSS

CVE•added 2015/04/10 2:59 p.m.•44 views

CVE-2015-1126

WebKit, as used in Apple iOS before 8.3 and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, does not properly handle the userinfo field in FTP URLs, which allows remote attackers to trigger incorrect resource access via unspecified vectors.

4.3CVSS7.5AI score0.65446EPSS

CVE•added 2015/04/10 2:59 p.m.•42 views

CVE-2015-1112

Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, as used on iOS before 8.3 and other platforms, does not properly delete browsing-history data from the history.plist file, which allows attackers to obtain sensitive information by reading this file.

5CVSS5AI score0.00336EPSS

CVE•added 2015/04/10 2:59 p.m.•39 views

CVE-2015-1128

The private-browsing implementation in Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5 allows attackers to obtain sensitive browsing-history information via vectors involving push-notification requests.

5CVSS5.3AI score0.00297EPSS

CVE•added 2015/12/11 11:59 a.m.•37 views

CVE-2015-7093

Safari in Apple iOS before 9.2 allows remote attackers to spoof a URL in the user interface via a crafted web site.

4.3CVSS5.8AI score0.00266EPSS

Total number of security vulnerabilities134