CVSS: 4.3EPSS: 1%CPEs: 34EXPL: 1CVE-2009-1681
https://notcve.org/view.php?id=CVE-2009-1681
10 Jun 2009 — WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not prevent web sites from loading third-party content into a subframe, which allows remote attackers to bypass the Same Origin Policy and conduct "clickjacking" attacks via a crafted HTML document. WebKit en Apple Safari anteriores a v4.0 no previene que páginas web sean cargadas en contenidos de terceros dentro de un "submarco", lo que permite a los atacantes remotos evitar la Política Origi... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html •
CVSS: 6.1EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1691
https://notcve.org/view.php?id=CVE-2009-1691
10 Jun 2009 — Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to insufficient access control for standard JavaScript prototypes in other domains. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en WebKit en Apple Safari anterior a v4.0 permite a atacantes remotos inyectar secuencias de comandos web a su elección o HT... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 34EXPL: 1CVE-2009-1682
https://notcve.org/view.php?id=CVE-2009-1682
10 Jun 2009 — Apple Safari before 4.0 does not properly check for revoked Extended Validation (EV) certificates, which makes it easier for remote attackers to trick a user into accepting an invalid certificate. Apple Safari antes de v4.0 no comprueba adecuadamente la revocación de certificados Extended Validation (EV), lo cual hace más fácil a atacantes remotos engañar a un usuario para aceptar un certificado no válido. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-255: Credentials Management Errors •
CVSS: 5.8EPSS: 0%CPEs: 34EXPL: 0CVE-2009-1694
https://notcve.org/view.php?id=CVE-2009-1694
10 Jun 2009 — WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle redirects, which allows remote attackers to read images from arbitrary web sites via vectors involving a CANVAS element and redirection, related to a "cross-site image capture issue." WebKit en Apple Safari anterior a v4.0 no redirecciona correctamente, lo que permite a atacantes remotos leer las imágenes de sitios web a su eleccion a traves de vectores relacionados al elem... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html •
CVSS: 5.8EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1693
https://notcve.org/view.php?id=CVE-2009-1693
10 Jun 2009 — WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to read images from arbitrary web sites via a CANVAS element with an SVG image, related to a "cross-site image capture issue." WebKit en Apple Safari anteriores a v4.0 permite a atacantes remotos leer imágenes desde sitios Web de su elección a través de un elemento CANVAS con una imagen SVG, relativo a "Característica de captura de imagen en sitio cruzado". • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html •
CVSS: 9.3EPSS: 1%CPEs: 34EXPL: 1CVE-2009-1686
https://notcve.org/view.php?id=CVE-2009-1686
10 Jun 2009 — WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle constant (aka const) declarations in a type-conversion operation during JavaScript exception handling, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document. WebKit en Apple Safari antes de v4.0 no maneja adecuadamente constantes (alias const) declaradas en una operación de ... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 3%CPEs: 34EXPL: 1CVE-2009-1687 – kdelibs: Integer overflow in KJS JavaScript garbage collector
https://notcve.org/view.php?id=CVE-2009-1687
10 Jun 2009 — The JavaScript garbage collector in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 does not properly handle allocation failures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document that triggers write access to an "offset of a NULL pointer." El JavaScript garbage collector en WebKit en Apple Safari anteriores a v4.0 no maneja adecuadamente la ... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html • CWE-190: Integer Overflow or Wraparound CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 6%CPEs: 76EXPL: 1CVE-2009-1690 – kdelibs: KHTML Incorrect handling <head> element content once the <head> element was removed (DoS, ACE)
https://notcve.org/view.php?id=CVE-2009-1690
10 Jun 2009 — Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, iPhone OS for iPod touch 1.1 through 2.2.1, Google Chrome 1.0.154.53, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) by setting an unspecified property of an HTML tag that causes child elements to be freed and later accessed when an HTML error occurs, related to "recursion in certain DOM event handlers.... • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=803 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 3%CPEs: 48EXPL: 1CVE-2009-1701 – Apple WebKit dir Attribute Freeing Dangling Object Pointer Vulnerability
https://notcve.org/view.php?id=CVE-2009-1701
08 Jun 2009 — Use-after-free vulnerability in the JavaScript DOM implementation in WebKit in Apple Safari before 4.0, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 through 2.2.1 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by destroying a document.body element that has an unspecified XML container with elements that support the dir attribute. Vulnerabilidad de uso después de la liberación en la implementación en WebKit en Apple Safari anteriores a v4.0... • http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 4%CPEs: 34EXPL: 0CVE-2009-1709 – Apple Safari SVG Set.targetElement() Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2009-1709
08 Jun 2009 — Use-after-free vulnerability in the garbage-collection implementation in WebCore in WebKit in Apple Safari before 4.0 allows remote attackers to execute arbitrary code or cause a denial of service (heap corruption and application crash) via an SVG animation element, related to SVG set objects, SVG marker elements, the targetElement attribute, and unspecified "caches." Vulnerabilidad de uso después de la liberación en la implementación de la recolección de basura en WebCore en WebKit en Apple Safari anterior... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-399: Resource Management Errors CWE-416: Use After Free •