CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-4676
https://notcve.org/view.php?id=CVE-2016-4676
A Cross-origin vulnerability exists in WebKit in Apple Safari before 10.0.1 when processing location attributes, which could let a remote malicious user obtain sensitive information. Se presenta una vulnerabilidad de origen cruzado en WebKit en Apple Safari versiones anteriores a 10.0.1 al procesar atributos de ubicación, lo que podría permitir a un usuario malicioso remoto obtener información confidencial. • http://seclists.org/fulldisclosure/2016/Oct/89 http://www.securityfocus.com/bid/93851 http://www.securitytracker.com/id/1037087 https://lists.apple.com/archives/security-announce/2016/Oct/msg00002.html https://packetstormsecurity.com/files/cve/CVE-2016-4676 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-4677 – Apple Safari JavaScriptCore Array Out-Of-Bounds Access Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2016-4677
An issue was discovered in certain Apple products. iOS before 10.1 is affected. Safari before 10.0.1 is affected. tvOS before 10.0.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Se ha descubierto un problema en ciertos productos Apple. iOS en versiones anteriores a 10.1 está afectado. • http://www.securityfocus.com/bid/93853 http://www.securitytracker.com/id/1037087 https://support.apple.com/HT207270 https://support.apple.com/HT207271 https://support.apple.com/HT207272 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-4751
https://notcve.org/view.php?id=CVE-2016-4751
The Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address bar of a tab via a crafted web site. El componente Safari Tabs en Apple Safari en versiones anteriores a 10 permite a atacantes remotos suplantar la barra de dirección de una pestaña a través de un sitio web manipulado. • http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html http://www.securityfocus.com/bid/93058 http://www.securitytracker.com/id/1036854 https://support.apple.com/HT207157 • CWE-254: 7PK - Security Features •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2016-4758
https://notcve.org/view.php?id=CVE-2016-4758
WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location variable, which allows remote attackers to obtain sensitive information via a crafted web site. WebKit en Apple iOS en versiones anteriores a 10, iTunes en versiones anteriores a 12.5.1 en Windows y Safari en versiones anteriores a 10 no restringe adecuadamente al acceso a la variable de localización, lo que permite a atacantes remotos obtener información sensible a través de un sitio web manipulado. • http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html http://lists.apple.com/archives/security-announce/2016/Sep/msg00012.html http://mksben.l0.cm/2016/09/safari-uxss-showModalDialog.html http://www.securityfocus.com/bid/93066 http://www.securitytracker.com/id/1036854 https://support.apple.com/HT207143 https://support.apple.com/HT207157 https://support.apple.com/HT207158 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2016-4611
https://notcve.org/view.php?id=CVE-2016-4611
WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2016-4730, CVE-2016-4733, CVE-2016-4734, and CVE-2016-4735. WebKit en Apple iOS en versiones anteriores a 10, Safari en versiones anteriores a 10 y tvOS en versiones anteriores a 10 permite a atacantes remotos ejecutar un código arbitrario o provocar una denegación de servicio (corrupción de memoria) a través de un sitio web manipulado, una vulnerabilidad distinta de CVE-2016-4730, CVE-2016-4733, CVE-2016-4734 y CVE-2016-4735. • http://lists.apple.com/archives/security-announce/2016/Sep/msg00007.html http://lists.apple.com/archives/security-announce/2016/Sep/msg00008.html http://lists.apple.com/archives/security-announce/2016/Sep/msg00011.html http://www.securityfocus.com/bid/93057 http://www.securitytracker.com/id/1036854 https://support.apple.com/HT207142 https://support.apple.com/HT207143 https://support.apple.com/HT207157 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •