CVSS: 6.5EPSS: 1%CPEs: 4EXPL: 1CVE-2017-2365 – Apple WebKit 10.0.2 - 'Frame::setDocument' Universal Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-2365
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. Se ha descubierto un problema en ciertos productos Apple. iOS en versiones anteriores a 10.2.1 está afectado. • https://www.exploit-db.com/exploits/41453 http://www.securityfocus.com/bid/95727 http://www.securitytracker.com/id/1037668 https://security.gentoo.org/glsa/201706-15 https://support.apple.com/HT207482 https://support.apple.com/HT207484 https://support.apple.com/HT207485 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 5EXPL: 1CVE-2017-2360 – Apple macOS 10.12.1 / iOS Kernel - 'host_self_trap' Use-After-Free
https://notcve.org/view.php?id=CVE-2017-2360
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. macOS before 10.12.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (use-after-free) via a crafted app. Se ha descubierto un problema en ciertos productos Apple. iOS en versiones anteriores a 10.2.1 está afectado. macOS en versiones anteriores a 10.12.3 está afectado. tvOS en versiones anteriores a 10.1.1 está afectado. watchOS en versiones anteriores a 3.1.3 está afectado. El problema involucra al componente "Kernel". • https://www.exploit-db.com/exploits/41165 http://www.securityfocus.com/bid/95729 http://www.securityfocus.com/bid/95731 http://www.securitytracker.com/id/1037668 https://support.apple.com/HT207482 https://support.apple.com/HT207483 https://support.apple.com/HT207485 https://support.apple.com/HT207487 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-2354 – Apple Safari SearchInputType Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-2354
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Se ha descubierto un problema en ciertos productos Apple. iOS en versiones anteriores a 10.2.1 está afectado. • http://www.securityfocus.com/bid/95736 http://www.securitytracker.com/id/1037668 https://security.gentoo.org/glsa/201706-15 https://support.apple.com/HT207481 https://support.apple.com/HT207482 https://support.apple.com/HT207484 https://support.apple.com/HT207485 https://support.apple.com/HT207486 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-4761
https://notcve.org/view.php?id=CVE-2016-4761
WebKitGTK+ before 2.14.0: A use-after-free vulnerability can allow remote attackers to cause a DoS WebKitGTK+ versiones anteriores a 2.14.0: una vulnerabilidad de uso de la memoria previamente liberada puede permitir a atacantes remotos causar una DoS. • http://www.openwall.com/lists/oss-security/2016/11/04/14 http://www.ubuntu.com/usn/USN-3166-1 • CWE-416: Use After Free •
CVSS: 3.1EPSS: 0%CPEs: 5EXPL: 0CVE-2016-4583
https://notcve.org/view.php?id=CVE-2016-4583
WebKit in Apple iOS before 9.3.3, Safari before 9.1.2, and tvOS before 9.2.2 allows remote attackers to bypass the Same Origin Policy and obtain image date from an unintended web site via a timing attack involving an SVG document. WebKit en Apple iOS en versiones anteriores a 9.3.3, Safari en versiones anteriores a 9.1.2 y tvOS en versiones anteriores a 9.2.2 permite a atacantes remotos eludir la Same Origin Policy y obtener la fecha de imagen de un sitio web no intencionado a través de un ataque de sincronización que implica un documento SVG. • http://lists.apple.com/archives/security-announce/2016/Jul/msg00001.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00003.html http://lists.apple.com/archives/security-announce/2016/Jul/msg00004.html http://packetstormsecurity.com/files/138502/WebKitGTK-SOP-Bypass-Information-Disclosure.html http://www.securityfocus.com/archive/1/539295/100/0/threaded http://www.securityfocus.com/bid/91830 http://www.securitytracker.com/id/1036343 https://support.apple.com/HT206900 https:/&# • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •