CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2012-0678
https://notcve.org/view.php?id=CVE-2012-0678
Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Apple Safari anterior a v6.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un feed :// URL. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://support.apple.com/kb/HT5400 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2012-3696
https://notcve.org/view.php?id=CVE-2012-3696
CRLF injection vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP request splitting attacks via a crafted web site that leverages improper WebSockets URI handling. Una vulnerabilidad de inyección CRLF en el WebKit de Apple Safari anterior a v6.0 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de división de solicitud HTTP a través de una página web diseñada que aprovecha el mal manejo de WebSockets URI. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 http://www.securityfocus.com/bid/54700 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 102EXPL: 0CVE-2012-0680
https://notcve.org/view.php?id=CVE-2012-0680
Apple Safari before 6.0 does not properly handle the autocomplete attribute of a password input element, which allows remote attackers to bypass authentication by leveraging an unattended workstation. Apple Safari anterior a v6.0 no maneja correctamente el atributo autocomplete de un elemento de entrada de contraseña, que permite a atacantes remotos eludir la autenticación mediante el aprovechamiento de una estación de trabajo sin supervisión. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 http://www.securityfocus.com/bid/54688 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2012-3695
https://notcve.org/view.php?id=CVE-2012-3695
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML by leveraging improper URL canonicalization during the handling of the location.href property. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en WebKit de Apple Safari antes de v6.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante el aprovechamiento de la normalización de URL incorrecta en el manejo de la propiedad location.href. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 http://www.securityfocus.com/bid/54695 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 102EXPL: 0CVE-2012-3691
https://notcve.org/view.php?id=CVE-2012-3691
WebKit in Apple Safari before 6.0 does not properly handle Cascading Style Sheets (CSS) property values, which allows remote attackers to bypass the Same Origin Policy via a crafted web site. WebKit de Apple Safari antes de v6.0 no maneja adecuadamente los valores de propiedad de las hojas de estilo en cascada (CSS), lo que permite a atacantes remotos evitar la Same Origin Policy a través de un sitio web modificado. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 • CWE-20: Improper Input Validation •