Page 120 of 1325 results (0.019 seconds)

CVSS: 4.3EPSS: 0%CPEs: 59EXPL: 0

CVE-2009-2842

https://notcve.org/view.php?id=CVE-2009-2842

13 Nov 2009 — Apple Safari before 4.0.4 does not properly implement certain (1) Open Image and (2) Open Link menu options, which allows remote attackers to read local HTML files via a crafted web site. Apple Safari en versiones anteriores a la 4.0.4 no implementa de manera apropiada las opciones de menu (1) Open Image y (2) Open Link, lo que permite a atacantes remotos leer ficheros HTML locales mediante un sitio web manipulado. • http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html •

CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0

CVE-2009-2816

https://notcve.org/view.php?id=CVE-2009-2816

13 Nov 2009 — The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, as used in Apple Safari before 4.0.4 and Google Chrome before 3.0.195.33, includes certain custom HTTP headers in the OPTIONS request during cross-origin operations with preflight, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web page. La implementación de Cross-Origin Resource Sharing (CORS) en WebKit, tal como es usado en Safari de Apple anterior a versión 4.0.4 y Chrome d... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 9.3EPSS: 0%CPEs: 69EXPL: 0

CVE-2009-3384 – Firefox integer underflow in FTP directory list parser

https://notcve.org/view.php?id=CVE-2009-3384

13 Nov 2009 — Multiple unspecified vulnerabilities in WebKit in Apple Safari before 4.0.4 on Windows allow remote FTP servers to execute arbitrary code, cause a denial of service (application crash), or obtain sensitive information via a crafted directory listing in a reply. Múltiples vulnerabilidades no especificadas en WebKit en Apple Safari en versiones anteriores a la 4.0.4 en Windows permiten a servidores FTP remotos ejecutar código de su elección, provocar una denegación de servicio (caída de la aplicación) o obten... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html • CWE-190: Integer Overflow or Wraparound •

CVSS: 7.5EPSS: 0%CPEs: 48EXPL: 0

CVE-2009-3455

https://notcve.org/view.php?id=CVE-2009-3455

29 Sep 2009 — Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Apple Safari, posiblemente anterior a v4.0.3, en Mac OS X no maneja adecuadamente un carácter '\0' en un nombre de dominio de sujeto en el campo Common Name (C... • http://www.networkworld.com/news/2009/091709-microsoft-ie-security-hole.html • CWE-310: Cryptographic Issues •

CVSS: 8.8EPSS: 2%CPEs: 73EXPL: 0

CVE-2009-2804

https://notcve.org/view.php?id=CVE-2009-2804

14 Sep 2009 — Integer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5.8, and Safari before 4.0.4 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted ColorSync profile embedded in an image, leading to a heap-based buffer overflow. Un desbordamiento enteros en ColorSync en Mac OS X versiones 10.4.11 y 10.5.8, y Safari anterior a versión 4.0.4, de Apple, en Windows, permite a los atacantes remotos ejecutar código arbitrario o causar una denega... • http://lists.apple.com/archives/security-announce/2009/Nov/msg00001.html • CWE-189: Numeric Errors •

CVSS: 7.1EPSS: 0%CPEs: 81EXPL: 0

CVE-2009-2200

https://notcve.org/view.php?id=CVE-2009-2200

12 Aug 2009 — WebKit in Apple Safari before 4.0.3 does not properly restrict the URL scheme of the pluginspage attribute of an EMBED element, which allows user-assisted remote attackers to launch arbitrary file: URLs and obtain sensitive information via a crafted HTML document. WebKit en Apple Safari anteriores a v4.0.3 no restringe apropiadamente el esquema URL del atributo pluginspage de un elemento EMBED, lo que permite a los atacantes remotos asistidos por usuarios lanzar un archivo arbitrario: URLs y obtener informa... • http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.3EPSS: 80%CPEs: 81EXPL: 1

CVE-2009-2195 – WebKit - Floating Point Number Remote Buffer Overflow

https://notcve.org/view.php?id=CVE-2009-2195

12 Aug 2009 — Buffer overflow in WebKit in Apple Safari before 4.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted floating-point numbers. Desbordamiento de búfer en WebKit en Apple Safari anteriores a v4.0.3, permite a los atacantes remotos ejecutar arbitrariamente código o causar una denegación de servicio (caída de la aplicación) a través de un número punto-flotante manipulado. • https://www.exploit-db.com/exploits/33164 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •

CVSS: 6.5EPSS: 1%CPEs: 74EXPL: 0

CVE-2009-2199

https://notcve.org/view.php?id=CVE-2009-2199

12 Aug 2009 — Incomplete blacklist vulnerability in WebKit in Apple Safari before 4.0.3, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms, allows remote attackers to spoof domain names in URLs, and possibly conduct phishing attacks, via unspecified homoglyphs. Una vulnerabilidad de lista negra incompleta en WebKit en Safari de Apple anterior a versión 4.0.3, como es usado en iPhone OS anterior a versión 3.1, iPhone OS anterior a versión 3.1.1, para iPod touch y otras plataformas... • http://lists.apple.com/archives/security-announce/2009/Aug/msg00002.html •

CVSS: 6.5EPSS: 0%CPEs: 38EXPL: 0

CVE-2009-2416 – mingw32-libxml2: Pointer use-after-free flaws by parsing Notation and Enumeration attribute types

https://notcve.org/view.php?id=CVE-2009-2416

11 Aug 2009 — Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework. Múltiples vulnerabilidades de uso anterior a la liberación en libxml2 v2.5.10, v2.6.16, v2.6.26, v2.6.27, y v2.6.32, y libxml v1.8.17, permite a atacantes dependientes de contexto p... • http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html • CWE-416: Use After Free •

CVSS: 9.3EPSS: 3%CPEs: 73EXPL: 0

CVE-2009-1725

https://notcve.org/view.php?id=CVE-2009-1725

09 Jul 2009 — WebKit in Apple Safari before 4.0.2, as used on iPhone OS before 3.1, iPhone OS before 3.1.1 for iPod touch, and other platforms; KHTML in kdelibs in KDE; QtWebKit (aka Qt toolkit); and possibly other products do not properly handle numeric character references, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. WebKit en Apple Safari anterior a v4.0.2, no maneja adecuadamente las referencias de caracter... • http://lists.apple.com/archives/security-announce/2009/Jul/msg00000.html • CWE-189: Numeric Errors •