CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2011-1295
https://notcve.org/view.php?id=CVE-2011-1295
WebKit, as used in Google Chrome before 10.0.648.204 and Apple Safari before 5.0.6, does not properly handle node parentage, which allows remote attackers to cause a denial of service (DOM tree corruption), conduct cross-site scripting (XSS) attacks, or possibly have unspecified other impact via unknown vectors. WebKit, tal y como es usado en Google Chrome anterior a versión 10.0.648.204 y Apple Safari anterior a la versión 5.0.6, no maneja apropiadamente el parentesco entre nodos, lo que permite a los atacantes remotos causar una denegación de servicio (corrupción del árbol DOM), conducir ataques de tipo cross-site scripting (XSS), o posiblemente tener otro impacto no especificado por medio de vectores desconocidos. • http://code.google.com/p/chromium/issues/detail?id=74991 http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html http://secunia.com/advisories/43859 http://support.apple.com/kb/HT4808 http://support.apple.com/kb/HT4999 http://www.securityfocus.com/bid/47029 http://www.vupen.com/english/advisories/2011/0765 htt • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2011-1293
https://notcve.org/view.php?id=CVE-2011-1293
Use-after-free vulnerability in the HTMLCollection implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. Vulnerabilidad uso después de liberación en la aplicación HTMLCollection en Google Chrome antes de v10.0.648.204 permite a atacantes remotos provocar una denegación de servicio o posiblemente tener un impacto no especificado a través de vectores desconocidos. • http://code.google.com/p/chromium/issues/detail?id=73595 http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html http://secunia.com/advisories/43859 http://support.apple.com/kb/HT4808 http://support.apple.com/kb/HT4981 http://support.app • CWE-416: Use After Free •
CVSS: 7.5EPSS: 1%CPEs: 4EXPL: 0CVE-2011-1296
https://notcve.org/view.php?id=CVE-2011-1296
Google Chrome before 10.0.648.204 does not properly handle SVG text, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer." Google Chrome antes de v10.0.648.204 no controla correctamente el texto SVG, lo que permite a atacantes remotos provocar una denegación de servicio o posiblemente tener un impacto no especificado a través de vectores desconocidos que dan lugar a un puntero bloqueado. • http://code.google.com/p/chromium/issues/detail?id=75170 http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html http://lists.apple.com/archives/security-announce/2011//Jul/msg00002.html http://secunia.com/advisories/43859 http://support.apple.com/kb/HT4808 http://support.apple.com/kb/HT4981 http://support.app • CWE-20: Improper Input Validation •
CVSS: 2.6EPSS: 0%CPEs: 65EXPL: 0CVE-2011-0169
https://notcve.org/view.php?id=CVE-2011-0169
WebKit in Apple Safari before 5.0.4, when the Web Inspector is used, does not properly handle the window.console._inspectorCommandLineAPI property, which allows user-assisted remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site. WebKit en Apple Safari antes de v5.0.4, cuando el Inspector Web se utiliza, no controla correctamente la propiedad window.console._inspectorCommandLineAPI, que permite a atacantes remotos asistidos por el usuario eludir la Same Origin Policy y llevar a cabo ataques de ejecución de secuencias de comandos en sitios cruzados (XSS) a través de un sitio web manipulado. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://support.apple.com/kb/HT4566 http://www.securityfocus.com/bid/46809 http://www.securitytracker.com/id?1025183 https://exchange.xforce.ibmcloud.com/vulnerabilities/66006 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 96EXPL: 0CVE-2011-0160
https://notcve.org/view.php?id=CVE-2011-0160
WebKit, as used in Apple Safari before 5.0.4 and iOS before 4.3, does not properly handle redirects in conjunction with HTTP Basic Authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header. WebKit, tal como se utiliza en Apple Safari antes de v5.0.4 e iOS antes de v4.3, no controla correctamente las redirecciones en conjunto con la autenticación básica HTTP, lo que podría permitir a los servidores Web remotos capturar las credenciales de registro de la cabecera HTTP de autorización. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 http://www.securitytracker.com/id?1025182 • CWE-20: Improper Input Validation •