CVSS: 5.0EPSS: 0%CPEs: 99EXPL: 0CVE-2012-0647
https://notcve.org/view.php?id=CVE-2012-0647
WebKit in Apple Safari before 5.1.4 does not properly handle redirects in conjunction with HTTP authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header. WebKit de Apple Safari anteriores a 5.1.4 no maneja apropiadamente las redirecciones junto con autenticación HTTP, lo que permite a servidores web remotos capturar las credenciales a través de la cabecera "Authorization HTTP". • http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html http://secunia.com/advisories/48377 http://www.securitytracker.com/id?1026785 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 98EXPL: 0CVE-2012-0640
https://notcve.org/view.php?id=CVE-2012-0640
WebKit in Apple Safari before 5.1.4 does not properly implement "From third parties and advertisers" cookie blocking, which makes it easier for remote web servers to track users via a cookie. WebKit de Apple Safari anteriores a 5.1.4 no implementa apropiadamente el bloqueo de cookies "de terceras partes y anunciantes", lo que facilita a servidores web remotos realizar un segumiento del usuario a través de una cookie. • http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html http://secunia.com/advisories/48377 http://www.securitytracker.com/id?1026785 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 10.0EPSS: 2%CPEs: 4EXPL: 0CVE-2011-3046
https://notcve.org/view.php?id=CVE-2011-3046
The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue. El subsistema de extensión en Google Chrome antes de v17.0.963.78 no gestiona adecuadamente el historial de navegación, lo que permite a atacantes remotos ejecutar código de su elección qaprovechandose de un problema "XSS universal(UXSS)". • http://code.google.com/p/chromium/issues/detail?id=117226 http://code.google.com/p/chromium/issues/detail?id=117230 http://googlechromereleases.blogspot.com/2012/03/chrome-stable-channel-update.html http://lists.apple.com/archives/security-announce/2012/May/msg00000.html http://lists.apple.com/archives/security-announce/2012/May/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00012.html http://secunia.com/advisories/47292 http://secunia.com/advisories/48321 http • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.6EPSS: 0%CPEs: 64EXPL: 0CVE-2012-0636
https://notcve.org/view.php?id=CVE-2012-0636
WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. WebKit, tal y como se usa en iTunes de Apple antes de v10.6, permite jecutar código de su elección a atacantes man-in-the-middle o causar una denegación de servicio (corrupción de memoria y caída de la aplicación) a través de vectores relacionados con la navegación por la tienda iTunes. Se trata de una vulnerabilidad diferente a otros CVEs enumerados en el APPLE-SA-2012-03-07-1. • http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html http://secunia.com/advisories/48274 http://secunia.com/advisories/48377 http://www.securityfocus.com/bid/52363 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17068 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 0%CPEs: 64EXPL: 0CVE-2012-0637
https://notcve.org/view.php?id=CVE-2012-0637
WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. WebKit, tal y como se usa en iTunes de Apple antes de v10.6, permite jecutar código de su elección a atacantes man-in-the-middle o causar una denegación de servicio (corrupción de memoria y caída de la aplicación) a través de vectores relacionados con la navegación por la tienda iTunes. Se trata de una vulnerabilidad diferente a otros CVEs enumerados en el APPLE-SA-2012-03-07-1. • http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html http://lists.apple.com/archives/security-announce/2012/Mar/msg00003.html http://secunia.com/advisories/48274 http://secunia.com/advisories/48377 http://www.securityfocus.com/bid/52363 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17469 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •