Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
AppleSafari

42 matches found

CVE
CVE•added 2007/02/01 12:28 a.m.•95 views

CVE-2007-0646

Format string vulnerability in iMovie HD 6.0.3, and Safari in Apple Mac OS X 10.4 through 10.4.10, allows remote user-assisted attackers to cause a denial of service (crash) via format string specifiers in a filename, which is not properly handled when calling the NSRunCriticalAlertPanel Apple AppK...

7.1CVSS6.9AI score0.16243EPSS
CVE
CVE•added 2007/06/12 10:30 p.m.•67 views

CVE-2007-3186

Apple Safari Beta 3.0.1 for Windows allows remote attackers to execute arbitrary commands via shell metacharacters in a URI in the SRC of an IFRAME, as demonstrated using a gopher URI.

9.3CVSS7.2AI score0.08926EPSS
CVE
CVE•added 2007/06/25 7:30 p.m.•63 views

CVE-2007-2400

Race condition in Apple Safari 3 Beta before 3.0.2 on Mac OS X, Windows XP, Windows Vista, and iPhone before 1.0.1, allows remote attackers to bypass the JavaScript security model and modify pages outside of the security domain and conduct cross-site scripting (XSS) attacks via vectors related to p...

4.3CVSS5.3AI score0.00304EPSS
CVE
CVE•added 2007/01/18 2:28 a.m.•62 views

CVE-2007-0342

WebCore in Apple WebKit build 18794 allows remote attackers to cause a denial of service (null dereference and application crash) via a TD element with a large number in the ROWSPAN attribute, as demonstrated by a crash of OmniWeb 5.5.3 on Mac OS X 10.4.8, a different vulnerability than CVE-2006-20...

7.5CVSS6.2AI score0.12657EPSS
CVE
CVE•added 2007/09/11 6:17 p.m.•61 views

CVE-2007-4812

Buffer overflow in Apple Safari 3.0.3 522.15.5, and other versions before Beta Update 3.0.4, allows remote attackers to cause a denial of service (crash) and possibly have other unspecified impact by setting document.location.hash to a long string. NOTE: the crash might actually occur in the alert ...

5CVSS6.8AI score0.04144EPSS
CVE
CVE•added 2007/04/24 4:19 p.m.•59 views

CVE-2007-2175

Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory when creating QTPointe...

7.6CVSS7.2AI score0.84873EPSS
CVE
CVE•added 2007/06/19 9:30 p.m.•59 views

CVE-2007-3274

Apple Safari 3.0 and 3.0.1 on Windows XP SP2 allows attackers to cause a denial of service (application crash) via JavaScript that sets the document.location variable, as demonstrated by an empty value of document.location.

4.3CVSS6AI score0.00388EPSS
CVE
CVE•added 2007/06/21 10:30 a.m.•56 views

CVE-2007-2398

Apple Safari 3.0.1 beta (522.12.12) on Windows allows remote attackers to modify the window title and address bar while filling the main window with arbitrary content by setting the location bar and using setTimeout() to create an event that modifies the window content, which could facilitate phish...

7.1CVSS6.3AI score0.01459EPSS
CVE
CVE•added 2007/01/25 12:28 a.m.•55 views

CVE-2007-0478

WebCore on Apple Mac OS X 10.3.9 and 10.4.10, as used in Safari, does not properly parse HTML comments in TITLE elements, which allows remote attackers to conduct cross-site scripting (XSS) attacks and bypass some XSS protection schemes by embedding certain HTML tags within an HTML comment.

4.3CVSS4.7AI score0.01342EPSS
CVE
CVE•added 2007/08/03 8:17 p.m.•55 views

CVE-2007-2408

WebKit in Apple Safari 3 Beta before Update 3.0.3 does not properly recognize an unchecked "Enable Java" setting, which allows remote attackers to execute Java applets via a crafted web page.

6.8CVSS6.3AI score0.00708EPSS
CVE
CVE•added 2007/07/23 4:30 p.m.•54 views

CVE-2007-3944

Multiple heap-based buffer overflows in the Perl Compatible Regular Expressions (PCRE) library in the JavaScript engine in WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, allow remote attackers to execute arbitrary code via certain JavaScript regular expressions. NOTE: t...

9.3CVSS7.4AI score0.36787EPSS
CVE
CVE•added 2007/11/29 1:46 a.m.•54 views

CVE-2007-6166

Stack-based buffer overflow in Apple QuickTime before 7.3.1, as used in QuickTime Player on Windows XP and Safari on Mac OS X, allows remote Real Time Streaming Protocol (RTSP) servers to execute arbitrary code via an RTSP response with a long Content-Type header.

9.3CVSS7.6AI score0.83919EPSS
CVE
CVE•added 2007/09/27 9:17 p.m.•53 views

CVE-2007-3756

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to obtain sensitive information via a crafted web page that identifies the URL of the parent window, even when the parent window is in a different domain.

4.3CVSS6.6AI score0.00991EPSS
CVE
CVE•added 2007/05/24 6:30 p.m.•50 views

CVE-2007-2843

Cross-domain vulnerability in Apple Safari 2.0.4 allows remote attackers to access restricted information from other domains via Javascript, as demonstrated by a js script that accesses the location information of cross-domain web pages, probably involving setTimeout and timed events.

10CVSS5.9AI score0.03069EPSS
CVE
CVE•added 2007/04/22 7:19 p.m.•48 views

CVE-2007-2163

Apple Safari allows remote attackers to cause a denial of service (browser crash) via JavaScript that matches a regular expression against a long string, as demonstrated using /(.)*/.

5CVSS6.2AI score0.00477EPSS
CVE
CVE•added 2007/06/12 10:30 p.m.•47 views

CVE-2007-3185

Apple Safari Beta 3.0.1 for Windows public beta allows remote attackers to cause a denial of service (crash) via unspecified DHTML manipulations that trigger memory corruption, as demonstrated using Hamachi.

7.8CVSS6.3AI score0.01482EPSS
CVE
CVE•added 2007/06/12 10:30 p.m.•47 views

CVE-2007-3187

Multiple unspecified vulnerabilities in Apple Safari for Windows allow remote attackers to cause a denial of service or execute arbitrary code, possibly involving memory corruption, and a different issue from CVE-2007-3185 and CVE-2007-3186. NOTE: as of 20070612, the original disclosure has no acti...

7.5CVSS7.6AI score0.08926EPSS
CVE
CVE•added 2007/09/27 10:17 p.m.•47 views

CVE-2007-3760

Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to inject arbitrary web script or HTML via frame tags.

4.3CVSS6.2AI score0.01182EPSS
CVE
CVE•added 2007/05/09 9:19 p.m.•46 views

CVE-2007-2580

Unspecified vulnerability in Apple Safari allows local users to obtain sensitive information (saved keychain passwords) via the document.loginform.password.value JavaScript parameter loaded from an AppleScript script.

1.9CVSS5.1AI score0.00264EPSS
CVE
CVE•added 2007/06/19 10:30 p.m.•46 views

CVE-2007-3284

corefoundation.dll in Apple Safari 3.0.1 (552.12.2) for Windows allows remote attackers to cause a denial of service (crash) via certain forms that trigger errors related to History, possibly involving multiple form fields with the same name.

7.8CVSS6.3AI score0.03548EPSS
CVE
CVE•added 2007/07/03 10:30 a.m.•46 views

CVE-2007-3514

Cross-domain vulnerability in Apple Safari for Windows 3.0.2 allows remote attackers to bypass the Same Origin Policy and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute to a file:// location, a ...

8.5CVSS5.9AI score0.00228EPSS
CVE
CVE•added 2007/08/03 8:17 p.m.•46 views

CVE-2007-3743

Stack-based buffer overflow in bookmark handling in Apple Safari 3 Beta before Update 3.0.3 on Windows allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a bookmark with a long title.

6.8CVSS7.8AI score0.01978EPSS
CVE
CVE•added 2007/08/18 10:17 p.m.•46 views

CVE-2007-4424

Apple Safari for Windows 3.0.3 and earlier does not prompt the user before downloading a file, which allows remote attackers to download arbitrary files to the desktop of a client system via certain HTML, as demonstrated by a filename in the DATA attribute of an OBJECT element. NOTE: it could be ar...

4.3CVSS6.4AI score0.00329EPSS
CVE
CVE•added 2007/08/03 8:17 p.m.•45 views

CVE-2007-3742

WebKit in Apple Safari 3 Beta before Update 3.0.3, and iPhone before 1.0.1, does not properly handle the interaction between International Domain Name (IDN) support and Unicode fonts, which allows remote attackers to create a URL containing "look-alike characters" (homographs) and possibly perform ...

4.3CVSS6.1AI score0.00538EPSS
CVE
CVE•added 2007/11/15 12:46 a.m.•45 views

CVE-2007-4692

The tabbed browsing feature in Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to spoof HTTP authentication for other sites and possibly conduct phishing attacks by causing an authentication sheet to be displayed for a tab that is not a...

4.3CVSS7.2AI score0.01126EPSS
CVE
CVE•added 2007/02/01 12:28 a.m.•44 views

CVE-2007-0644

Format string vulnerability in Apple Safari 2.0.4 (419.3) allows remote user-assisted attackers to cause a denial of service (crash) via format string specifiers in filenames that are not properly handled when calling the (1) NSLog and (2) NSBeginAlertSheet Apple AppKit functions.

7.1CVSS6.2AI score0.03634EPSS
CVE
CVE•added 2007/12/19 9:46 p.m.•44 views

CVE-2007-5858

WebKit in Safari in Apple Mac OS X 10.4.11 and 10.5.1, iPhone 1.0 through 1.1.2, and iPod touch 1.1 through 1.1.2 allows remote attackers to "navigate the subframes of any other page," which can be leveraged to conduct cross-site scripting (XSS) attacks and obtain sensitive information.

4.3CVSS7.9AI score0.01025EPSS
CVE
CVE•added 2007/07/12 4:30 p.m.•43 views

CVE-2007-3718

Multiple unspecified vulnerabilities in the SVG parsing engine in Apple Safari 3 Beta for Windows have unspecified remote attack vectors and impact. NOTE: this issue contains no actionable information, but it was released by a reliable researcher.

7.5CVSS6.8AI score0.00383EPSS
CVE
CVE•added 2007/09/27 10:17 p.m.•42 views

CVE-2007-3758

Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and in Mac OS X 10.4 through 10.4.10, allows remote attackers to set Javascript window properties for web pages that are in a different domain, which can be leveraged to conduct cross-site scripting (XSS) attacks.

4.3CVSS6.6AI score0.01387EPSS
CVE
CVE•added 2007/06/28 6:30 p.m.•41 views

CVE-2007-3482

Cross-domain vulnerability in Apple Safari for Windows 3.0.1 allows remote attackers to bypass the "same origin policy" and access restricted information from other domains via JavaScript that overwrites the document variable and statically sets the document.domain attribute.

7.8CVSS5.9AI score0.00228EPSS
CVE
CVE•added 2007/09/27 10:17 p.m.•40 views

CVE-2007-3759

Safari in Apple iPhone 1.1.1, when requested to disable Javascript, does not disable it until Safari is restarted, which might leave Safari open to attacks that the user does not expect.

6.8CVSS6AI score0.00703EPSS
CVE
CVE•added 2007/06/14 6:30 p.m.•39 views

CVE-2007-2391

Cross-site scripting (XSS) vulnerability in Apple Safari Beta 3.0.1 for Windows allows remote attackers to inject arbitrary web script or HTML via a web page that includes a windows.setTimeout function that is activated after the user has moved from the current page.

4.3CVSS5.2AI score0.00503EPSS
CVE
CVE•added 2007/09/27 10:17 p.m.•39 views

CVE-2007-3761

Cross-site scripting (XSS) vulnerability in Safari in Apple iPhone 1.1.1 allows remote attackers to inject arbitrary web script or HTML by causing Javascript events to be applied to a frame in another domain.

4.3CVSS5.2AI score0.00529EPSS
CVE
CVE•added 2007/06/25 8:30 p.m.•38 views

CVE-2007-3376

Buffer overflow in Apple Safari 3.0.2 on Windows XP SP2 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long value in the title HTML tag, which triggers the overflow when the user adds the page as a bookmark.

9.3CVSS7.6AI score0.0466EPSS
CVE
CVE•added 2007/09/27 9:17 p.m.•38 views

CVE-2007-3757

Safari in Apple iPhone 1.1.1 allows remote user-assisted attackers to trick the iPhone user into making calls to arbitrary telephone numbers via a crafted "tel:" link that causes iPhone to display a different number than the number that will be dialed.

4.3CVSS6.1AI score0.00993EPSS
CVE
CVE•added 2007/08/20 7:17 p.m.•38 views

CVE-2007-4431

Cross-domain vulnerability in Apple Safari for Windows 3.0.3 and earlier allows remote attackers to bypass the Same Origin Policy, with access from local zones to external domains, via a certain body.innerHTML property value, aka "classic JavaScript frame hijacking."

6.8CVSS6AI score0.00342EPSS
CVE
CVE•added 2007/09/27 10:17 p.m.•37 views

CVE-2007-4671

Unspecified vulnerability in Safari in Apple iPhone 1.1.1, and Safari 3 before Beta Update 3.0.4 on Windows and Mac OS X 10.4 through 10.4.10, allows remote attackers to "alter or access" HTTPS content via an HTTP session with a crafted web page that causes Javascript to be applied to HTTPS pages f...

6.8CVSS7.1AI score0.02687EPSS
CVE
CVE•added 2007/10/14 6:17 p.m.•37 views

CVE-2007-5450

Unspecified vulnerability in Safari on the Apple iPod touch (aka iTouch) and iPhone 1.1.1 allows user-assisted remote attackers to cause a denial of service (application crash), and enable filesystem browsing by the local user, via a certain TIFF file.

9.3CVSS6AI score0.01814EPSS
CVE
CVE•added 2007/12/19 9:46 p.m.•37 views

CVE-2007-5859

Unspecified vulnerability in Safari RSS in Apple Mac OS X 10.4.11 allows remote attackers to cause a denial of service (application termination) or execute arbitrary code via a crafted feed: URL that triggers memory corruption.

9.3CVSS9.1AI score0.22265EPSS
CVE
CVE•added 2007/11/15 2:46 a.m.•36 views

CVE-2007-4699

The default configuration of Safari in Apple Mac OS X 10.4 through 10.4.10 adds a private key to the keychain with permissions that allow other applications to access the key without warning the user, which might allow other applications to bypass intended access restrictions.

7.5CVSS7AI score0.00301EPSS
CVE
CVE•added 2007/12/28 9:46 p.m.•36 views

CVE-2007-6592

Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid cert...

4.3CVSS6.1AI score0.00153EPSS
CVE
CVE•added 2007/11/15 12:46 a.m.•35 views

CVE-2007-4698

Apple Safari 3 before Beta Update 3.0.4 on Windows, and Mac OS X 10.4 through 10.4.10, allows remote attackers to conduct cross-site scripting (XSS) attacks by causing JavaScript events to be associated with the wrong frame.

4.3CVSS6.5AI score0.01128EPSS