CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 0CVE-2009-2420
https://notcve.org/view.php?id=CVE-2009-2420
09 Jul 2009 — Apple Safari 3.2.3 does not properly implement the file: protocol handler, which allows remote attackers to read arbitrary files or cause a denial of service (launch of multiple Windows Explorer instances) via vectors involving an unspecified HTML tag, possibly a related issue to CVE-2009-1703. Apple Safari v3.2.3 no implementa correctamente el manejador de protocolo file: , lo cual permite a atacantes remotos leer ficheros arbitrarios o provocar una denegación de servicio (lanzar múltiples instancias del E... • http://www.securityfocus.com/archive/1/504480/100/0/threaded • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 66EXPL: 0CVE-2009-2072
https://notcve.org/view.php?id=CVE-2009-2072
15 Jun 2009 — Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server. Apple Safari no requiere un certificado cacheado antes de mostrar el icono del candado para una página https, lo que permite a los atacantes "hombre en el medio" suplantar una página web https enviando al naveg... • http://research.microsoft.com/apps/pubs/default.aspx?id=79323 • CWE-287: Improper Authentication •
CVSS: 7.4EPSS: 0%CPEs: 66EXPL: 0CVE-2009-2066
https://notcve.org/view.php?id=CVE-2009-2066
15 Jun 2009 — Apple Safari detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages." Apple Safari detecta contenido http en páginas https únicamente cuando el marco (frame) de nivel superior usa https, lo que permite a atacantes "hombre-e... • http://research.microsoft.com/apps/pubs/default.aspx?id=79323 • CWE-287: Improper Authentication •
CVSS: 6.8EPSS: 0%CPEs: 66EXPL: 0CVE-2009-2062
https://notcve.org/view.php?id=CVE-2009-2062
15 Jun 2009 — Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site. Apple Safari anteriores a v3.2.2 procesa una respuesta de CONEXIÓN HTTP anterior a una negociación SSL con éxito, lo que permite a los atacantes "hombre en el medio" ejecutar arbitrariamente una secuencia de comandos w... • http://research.microsoft.com/apps/pubs/default.aspx?id=79323 • CWE-287: Improper Authentication •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2058
https://notcve.org/view.php?id=CVE-2009-2058
15 Jun 2009 — Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack. Apple Safari anteriores a v3.2.2 utiliza una cabecera HTTP Host para determinar el contexto de un documento proporcionado por una respuesta de CONEXIÓN (1) 4xx o (2) 5xx desde un servidor proxy, lo que permite ... • http://research.microsoft.com/apps/pubs/default.aspx?id=79323 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2009-2027
https://notcve.org/view.php?id=CVE-2009-2027
10 Jun 2009 — The Installer in Apple Safari before 4.0 on Windows allows local users to gain privileges by checking a box that specifies an immediate launch of the application after installation, related to an unspecified compression method. El instalador en Apple Safari anterior a v4.0 en Windows permite a usuarios locales obtener privilegios marcando un cuadro (checkbox) que especifica que aplicación ejecutar después de la instalación, en relación con un método de compresión sin especificar. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.1EPSS: 0%CPEs: 34EXPL: 2CVE-2009-1703
https://notcve.org/view.php?id=CVE-2009-1703
10 Jun 2009 — WebKit in Apple Safari before 4.0 does not prevent references to file: URLs within (1) audio and (2) video elements, which allows remote attackers to determine the existence of arbitrary files via a crafted HTML document. WebKit en Apple Safari anterior a v4.0 no prevé las referencias a archivos; URLs con elementos de (1) audio y (2) vídeo, lo que permite a atacantes remotos determinar la existencia de archivos de su elección a través de un documento HTML manipulado. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1716
https://notcve.org/view.php?id=CVE-2009-1716
10 Jun 2009 — CFNetwork in Apple Safari before 4.0 on Windows does not properly protect the temporary files created for downloads, which allows local users to obtain sensitive information by reading these files. CFNetwork en Apple Safari anterior a v4.0 sobre Windows, no protege adecuadamente los ficheros temporales de las descargas que crea, lo que permite a usuarios locales obtener información sensible leyendo éstos archivos. • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1713 – Ubuntu Security Notice 857-1
https://notcve.org/view.php?id=CVE-2009-1713
10 Jun 2009 — The XSLT functionality in WebKit in Apple Safari before 4.0 does not properly implement the document function, which allows remote attackers to read (1) arbitrary local files and (2) files from different security zones via unspecified vectors. La funcionalidad XSLT en WebKit en Apple Safari anteriores a v4.0 no implementa adecuadamente la función "document", lo que permite a atacantes remotos leer (1) ficheros locales arbitrariamente (2) ficheros de diferentes zonas de seguridad a través de vectores inespec... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 34EXPL: 1CVE-2009-1714 – Debian Linux Security Advisory 1950-1
https://notcve.org/view.php?id=CVE-2009-1714
10 Jun 2009 — Cross-site scripting (XSS) vulnerability in Web Inspector in WebKit in Apple Safari before 4.0 allows user-assisted remote attackers to inject arbitrary web script or HTML, and read local files, via vectors related to the improper escaping of HTML attributes. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en Web Inspector en WebKit in Apple Safari anterior a v4.0, permite a atacantes asistidos por el usuario, inyectar secuencias comandos web o HTML de su elección y leer archivos lo... • http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •