CVSS: 7.1EPSS: 0%CPEs: 102EXPL: 0CVE-2012-3697
https://notcve.org/view.php?id=CVE-2012-3697
WebKit in Apple Safari before 6.0 does not properly handle file: URLs, which allows remote attackers to bypass intended sandbox restrictions and read arbitrary files by leveraging a WebProcess compromise. WebKit de Apple Safari antes de v6.0 no trata correctamente los archivos: URL, lo que permite a atacantes remotos eludir restricciones del entorno limitado y leer archivos arbitrarios mediante el aprovechamiento de un WebProcess comprometido. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://support.apple.com/kb/HT5400 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2012-0678
https://notcve.org/view.php?id=CVE-2012-0678
Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en Apple Safari anterior a v6.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un feed :// URL. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://support.apple.com/kb/HT5400 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2012-3696
https://notcve.org/view.php?id=CVE-2012-3696
CRLF injection vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP request splitting attacks via a crafted web site that leverages improper WebSockets URI handling. Una vulnerabilidad de inyección CRLF en el WebKit de Apple Safari anterior a v6.0 permite a atacantes remotos inyectar cabeceras HTTP arbitrarias y llevar a cabo ataques de división de solicitud HTTP a través de una página web diseñada que aprovecha el mal manejo de WebSockets URI. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 http://www.securityfocus.com/bid/54700 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 102EXPL: 0CVE-2012-0680
https://notcve.org/view.php?id=CVE-2012-0680
Apple Safari before 6.0 does not properly handle the autocomplete attribute of a password input element, which allows remote attackers to bypass authentication by leveraging an unattended workstation. Apple Safari anterior a v6.0 no maneja correctamente el atributo autocomplete de un elemento de entrada de contraseña, que permite a atacantes remotos eludir la autenticación mediante el aprovechamiento de una estación de trabajo sin supervisión. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 http://www.securityfocus.com/bid/54688 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 102EXPL: 0CVE-2012-3695
https://notcve.org/view.php?id=CVE-2012-3695
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML by leveraging improper URL canonicalization during the handling of the location.href property. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en WebKit de Apple Safari antes de v6.0 permite a atacantes remotos inyectar secuencias de comandos web o HTML mediante el aprovechamiento de la normalización de URL incorrecta en el manejo de la propiedad location.href. • http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 http://www.securityfocus.com/bid/54695 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •