Page 123 of 1290 results (0.013 seconds)

CVSS: 7.5EPSS: 2%CPEs: 34EXPL: 1

CVE-2009-1713

https://notcve.org/view.php?id=CVE-2009-1713

10 Jun 2009 — The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors. La funcionalidad XSLT en WebKit en Apple Safari anteriores a v4.0 no implementa adecuadamente la función "document", lo que permite a atacantes remotos leer (1) ficheros locales arbitrariamente (2) ficheros de diferentes zonas de seguridad a través de vectores inespec... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 34EXPL: 1

CVE-2009-1695

https://notcve.org/view.php?id=CVE-2009-1695

10 Jun 2009 — Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving access to frame contents after completion of a page transition. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebKit de Apple Safari anterior a v4.0, permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través de v... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 1

CVE-2009-1706

https://notcve.org/view.php?id=CVE-2009-1706

10 Jun 2009 — The Private Browsing feature in Apple Safari before 4.0 on Windows does not remove cookies from the alternate cookie store in unspecified circumstances upon (1) disabling of the feature or (2) exit of the application, which makes it easier for remote web servers to track users via a cookie. La característica de Navegación Privada de Apple Safari anterior a v4.0 en Windows no elimina las cookies del almacenamiento de cookies alternativo en circunstancias no especificadas en relación con (1) la desactivación ... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.3EPSS: 3%CPEs: 12EXPL: 1

CVE-2009-1705

https://notcve.org/view.php?id=CVE-2009-1705

10 Jun 2009 — CoreGraphics in Apple Safari before 4.0 on Windows does not properly use arithmetic during automatic hinting of TrueType fonts, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted font data. CoreGraphics en Apple Safari anteriores a v4.0 en Windows no utiliza adecuadamente la aritmética durante la inicialización automática de las fuentes TrueType, lo que permite a atacantes remotos ejecutar código de su elección o provoca... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-189: Numeric Errors •

CVSS: 9.3EPSS: 3%CPEs: 34EXPL: 1

CVE-2009-1708

https://notcve.org/view.php?id=CVE-2009-1708

10 Jun 2009 — Apple Safari before 4.0 does not prevent calls to the open-help-anchor URL handler by web sites, which allows remote attackers to open arbitrary local help files, and execute arbitrary code or obtain sensitive information, via a crafted call. Apple Safari anterior a v4.0 no previene las llamadas al manejador URL open-help-anchor por los sitios web, lo que permite a atacantes remotos abrir archivos de ayuda locales, ejecutar código de su elección u obtener información sensible a través de una llamada manipul... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html •

CVSS: 9.3EPSS: 1%CPEs: 34EXPL: 1

CVE-2009-1711

https://notcve.org/view.php?id=CVE-2009-1711

10 Jun 2009 — WebKit in Apple Safari before 4.0 does not properly initialize memory for Attr DOM objects, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document. WebKit en Apple Safari anterior a v4.0 no inicializa correctamente memoria para los objetos Attr DOM, lo cual permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (cuelgue de la aplicación) a través de un documento HTML elaborado. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-399: Resource Management Errors •

CVSS: 9.8EPSS: 3%CPEs: 34EXPL: 1

CVE-2009-1712

https://notcve.org/view.php?id=CVE-2009-1712

10 Jun 2009 — WebKit in Apple Safari before 4.0 does not prevent remote loading of local Java applets, which allows remote attackers to execute arbitrary code, gain privileges, or obtain sensitive information via an APPLET or OBJECT element. WebKit de Apple Safari anterior a v4.0 no previene la carga remota de los applets de Java locales, esto permite a atacante remotos ejecutar código de su elección, aumentar sus privilegios u obtener información sensible a través de un APPLET o elemento OBJECT. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 6.1EPSS: 1%CPEs: 34EXPL: 1

CVE-2009-1715

https://notcve.org/view.php?id=CVE-2009-1715

10 Jun 2009 — Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to script execution with incorrect privileges. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Web Inspector en WebKit en Apple Safari anteriores a v4.0 permite a atacantes remotos ayudados por por el usuario inyectar secuencias de comandos web o HTML, y leer ficheros locales... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 34EXPL: 1

CVE-2009-1688

https://notcve.org/view.php?id=CVE-2009-1688

10 Jun 2009 — Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to determining a security context through an approach that is not the "HTML 5 standard method." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en WebKit en Apple Safari anteriores a v4.0 permite a los atacantes remotos inyectar arbitrariament... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.8EPSS: 0%CPEs: 34EXPL: 1

CVE-2009-1693

https://notcve.org/view.php?id=CVE-2009-1693

10 Jun 2009 — WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to read images from arbitrary web sites via a CANVAS element with an SVG image, related to a "cross-site image capture issue." WebKit en Apple Safari anteriores a v4.0 permite a atacantes remotos leer imágenes desde sitios Web de su elección a través de un elemento CANVAS con una imagen SVG, relativo a "Característica de captura de imagen en sitio cruzado". • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html •